Researchers have identified a new campaign exploiting known vulnerabilities within Microsoft Office documents to deploy the “LokiBot” malware. The vulnerabilities, tracked as CVE-2021-40444 and CVE-2022-30190, are remote code execution (RCE) flaws that allow attackers to “embed malicious macros within Microsoft documents that, when executed, dropped the LokiBot malware onto the victim’s system.” LokiBot has been active since 2015 and is a well-known information-stealing Trojan that targets Windows devices. In their latest report, researchers explained that two types of Word documents were reviewed from the latest campaign. The first document contained an embedded link within an XML file and initially exploited CVE-2021-40444 and later in the attack chain downloads a file that exploits CVE-2022-30190. The second document contained a VBA script that downloads an injector from a specific URL for later use. Within the same folder of the injector file, researchers also noted that a file was found that loads LokiBot and connects to the command-and-control (C2) server. LokiBot’s goal is to collect sensitive information from multiple sources within victim devices, including web browsers, file transfer protocol (FTP), email accounts, and various installed software tools. It should be noted that both documents had similar lure images of Word experiencing an error while opening the document and requesting the user to enable editing. Windows users should remain vigilant of unexpected emails that prompt users to open hyperlinks or attachments. Indicators of compromise (IOCs) as well as additional technical details can be viewed in the report linked below.