A newly discovered phishing campaign, identified by Proofpoint researchers, has been observed targeting French organizations with cyberattacks leveraging Chocolatey, an open-source package installer. The targeted French organizations are within the construction, real estate, and government sectors, and the phishing emails contain macro-enabled Microsoft Word documents disguised as General Data Protection Regulations (GDPR) documentation. Researchers detailed that once macros are enabled, an encoded PowerShell script is grabbed via an image URL and steganography. The script “downloads, installs, and updates the Chocolatey installer package and repository script”, which the researchers noted has not been previously observed in campaigns. Through the attack chain, a backdoor called “Serpent” is attempted to be installed that has the potential to “enable remote administration, command and control (C2), data theft, or deliver other additional payloads”, but the objective of the threat actor responsible for this campaign is still currently unknown. It is emphasized, however, that the threat actor is likely an “advanced, targeted threat” due to the rarity of steganography being utilized in campaigns as well as additional tactics, techniques, and procedures (TTPs) being observed. An in-depth analysis and indicators of compromise (IOCs) can be reviewed in Proofpoint’s report linked below.