FAKE MICROSOFT OFFICE ADD-IN TOOLS PUSH MALWARE VIA SOURCEFORGE

Summary from the TLDR InfoSec newsletter

Kaspersky researchers discovered a threat actor that is using a SourceForge project page to host malware masquerading as the Microsoft Office-Addin-Scripts project. The page prompts users to download a password-protected zip file that contains an MSI file, which drops two RAR archives and downloads a batch script from GitHub. The batch script scans for antivirus and analysis tools, unpacks the archives, and runs another batch script, which sets up persistence, C2, and runs a cryptocurrency infostealer and crypto miner.