Once opened in a browser, the code decrypts a secondary payload using a static XOR key and then redirects the user to an ...

In previous campaign, the threat actor used MSI and EXE files. For the recent on, it switched to JavaScript files that had the following names: SYSTEM.Critical.Upgrade.Win10.0.ba45bd8ee89b1.js ...

This attack is made through embedded SVG files containing JavaScript that reassemble a Base64 encoded QBot malware installer that is automatically downloaded through the target's browser.

It has shown that the exploit will compromise any files it has access to in any parent directory to the website but not anything else. I'm at a loss on how to track down on what is causing this ...