Welcome to the Q1 2023 edition of the HP Wolf Security Threat Insights Report. In the report, we review notable malware campaigns, trends and techniques identified from HP Wolf Security’s customer telemetry in calendar Q1 2023.

Key Findings

• Q1 saw threat actors spreading malware through OneNote notebooks to bypass macro restrictions affecting some Microsoft Office file formats. The attacks trick victims into clicking on fake UI elements, triggering malicious scripts that download and infect PCs with backdoors and remote access trojans (RATs).
• In March, HP Wolf Security detected a new ChromeLoader malware campaign infecting victims with malicious Google Chrome extensions. The new variant, ChromeLoader Shampoo, is distributed through websites hosting pirated films and video games. The malware’s capabilities include redirecting search queries and injecting adverts into browsing sessions, so it is likely its operators are motivated by financial gain.
• Malware delivery techniques and file types continued to diversify in Q1, with some malicious spam distributors switching file types weekly. The volume of gzip and HTML threats seen by HP Wolf Security rose significantly in Q1, growing by 53% and 37% over Q4.
• Attackers tried to bypass Office’s macro restrictions in Q1 by using compromised Microsoft 365 accounts to send malicious emails to co-workers. The attackers attempted to infect PCs with Formbook, a malware family sold on hacking forums capable of recording keystrokes and stealing sensitive information.

Read the Report

Download the report: HP Wolf Security Threat Insights Report Q1 2023

Download (PDF)

Read all HP Wolf Security Threat Insights Reports

You can download and read our previous reports here.