PAPERMILL Hackers Use ISO Files to Bypass Windows Mark-of-the-Web and Deploy VenomRAT

A newly identified threat cluster dubbed PAPERMILL is using tax-audit phishing emails to deliver VenomRAT malware to Windows users. The campaign abuses ISO disk-image files, DLL sideloading, anti-analysis checks, and in-memory loaders to evade common security controls. JUMPSEC’s Detection and Response Team identified the activity after a phishing...