A new phishing campaign is targeting organizations in Eastern European countries with the Remcos RAT malware, with the help of an old Windows User Account Control bypass discovered more than two years ago.

The use of fake trusted directories to bypass Windows User Account Control is prominent in the attack, as it has been known since 2020 but continues to be effective today.

Watch out for bills!

Phishing campaign emails are sent from top-level domains that match the recipient's country and are often disguised as invoices, tender documents, and other financial documents.

Sample email from the campaign (SentinelOne)

You can go to the technical details of the news from Bleeping Computer.