Reposted by Corsin
Research note: procurement malware lures from one sender IP reused plausible supplier domains and JS/VBS archive children.
galileosignals.com/research/2026-10…
it security & cyber guy, research @ ecrime.ch, friendly, swiss | Opinions are my own