The Computer Emergency Response Team of Ukraine (CERT-UA) published an advisory on May 7, 2022, detailing a recent wave of “Jester Stealer” malware utilizing chemical attack-themed lures in phishing emails targeting individuals living in Ukraine. This scare tactic is designed to take advantage of the war between Russia and Ukraine as well as maximize the chance that recipients open the email and attachment. The machine-translated text says the following: “Today the information was received that chemical weapons will be used at 01.00 at night, the authorities are trying to hide it in order not to panic the population. Urgently get acquainted with the place where chemical weapons will be used and the places of special shelters where we will be safe. Help us to disseminate the information attached to the document in the letter as much as possible. map of the zone of chemical damage.” The message includes a Microsoft Excel document that, upon opening, enables malicious macros that then run an executable from a remote server on the victim computer. The executable downloads Jester Stealer, which is a known information-stealing trojan that, “steals data stored in browsers such as account passwords, messages on email clients, discussions on IM apps, and cryptocurrency wallet details.” The CERT-UA advisory detailed that this use case has anti-analysis functionality implemented but does not have any persistence measures. Jester Stealer is sold for $99/month and $249 for lifetime access, and the threat actor behind this current use against Ukraine is unknown at this time. CTIX analysts will continue to monitor for malware utilizing the Russian/Ukraine war as an advantage.