Excel's Blind Spot: Hackers' Strategy to Spread Agent Tesla Malware

Cyber attackers are exploiting an old Microsoft Office vulnerability to distribute a strain of malware known as Agent Tesla. These campaigns use decoy Excel documents in invoice-themed messages to deceive users into activating the CVE-2017-11882 vulnerability. The vulnerability allows an attacker to run arbitrary code in the context of the current user by failing to properly handle objects in memory, aka "Microsoft Office Memory Corruption Vulnerability". Agent Tesla functions as a Remote Access Trojan (RAT) and information stealer, built on the .NET framework.