{
	"id": "89ff4357-2e8c-4f60-845c-05671964e2c5",
	"created_at": "2026-04-06T00:16:16.932875Z",
	"updated_at": "2026-04-10T03:21:28.137231Z",
	"deleted_at": null,
	"sha1_hash": "2492a9b5aaa88b789b5511e40cc83bc129656b9d",
	"title": "QBot uses Windows Defender Antivirus phishing bait to infect PCs",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 2832051,
	"plain_text": "QBot uses Windows Defender Antivirus phishing bait to infect PCs\r\nBy Lawrence Abrams\r\nPublished: 2020-10-12 · Archived: 2026-04-05 12:36:25 UTC\r\nThe Qbot botnet uses a new template for the distribution of their malware that uses a fake Windows Defender Antivirus\r\ntheme to trick you into enabling Excel macros.\r\nQbot, otherwise known as QakBot or QuakBot, is Windows malware that steals bank credentials, Windows domain\r\ncredentials, and provides remote access to threat actors who install ransomware.\r\nVictims usually become infected with Qbot through another malware infection or via phishing campaigns using various\r\nlures, including fake invoices, payment and banking information, scanned documents, or invoices.\r\nhttps://www.bleepingcomputer.com/news/security/qbot-uses-windows-defender-antivirus-phishing-bait-to-infect-pcs/\r\nPage 1 of 4\n\n0:00\r\nhttps://www.bleepingcomputer.com/news/security/qbot-uses-windows-defender-antivirus-phishing-bait-to-infect-pcs/\r\nPage 2 of 4\n\nVisit Advertiser websiteGO TO PAGE\r\nAttached to these spam emails are malicious Excel (.xls) attachments. When opened, these attachments will prompt a user to\r\n'Enable Content' so that malicious macros will run to install the Qbot malware on a victim's computer.\r\nTo trick a user into clicking the 'Enable Content button, and thus enabling macros, threat actors use stylized document\r\ntemplates that pretend to be from a trustworthy organization or from your operating system.\r\nOn August 25th, the Qbot switched to a new template that pretends to be an alert from Windows Defender\r\nAntivirus, claiming that the document is encrypted.\r\nTo decrypt the document, users need to click on 'Enable Editing' or 'Enable Content' to decrypt it using the 'Microsoft Office\r\nDecryption Core.'\r\nNew 'Windows Defender Antivirus' Qbot attachment\r\nOnce enable content is clicked, malicious macros will be executed that download and install the Emotet malware on a\r\nvictim's computer.\r\nTo people who work in cybersecurity, are IT admins, or Windows enthusiasts, the above message appears silly and made up.\r\nTo casual users, though, it is convincing enough that many would follow the instructions and become infected with Qbot.\r\nWhy it's essential to recognize Qbot attachments?\r\nOver the past couple of months, Qbot has seen increased distribution, especially after being delivered in spam spewed forth\r\nby the Emotet botnet.\r\nWhen infected, Qbot performs various malicious activities that allow threat actors to gain access to your bank accounts and\r\nyour network.\r\nOnce they gain access to a network, they install ransomware such as ProLock throughout the system.\r\nDue to this, it is vital to recognize the malicious document templates used by Qbot so that you do not accidentally become\r\ninfected. \r\nhttps://www.bleepingcomputer.com/news/security/qbot-uses-windows-defender-antivirus-phishing-bait-to-infect-pcs/\r\nPage 3 of 4\n\nAutomated Pentesting Covers Only 1 of 6 Surfaces.\r\nAutomated pentesting proves the path exists. BAS proves whether your controls stop it. Most teams run one without the\r\nother.\r\nThis whitepaper maps six validation surfaces, shows where coverage ends, and provides practitioners with three diagnostic\r\nquestions for any tool evaluation.\r\nSource: https://www.bleepingcomputer.com/news/security/qbot-uses-windows-defender-antivirus-phishing-bait-to-infect-pcs/\r\nhttps://www.bleepingcomputer.com/news/security/qbot-uses-windows-defender-antivirus-phishing-bait-to-infect-pcs/\r\nPage 4 of 4",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://www.bleepingcomputer.com/news/security/qbot-uses-windows-defender-antivirus-phishing-bait-to-infect-pcs/"
	],
	"report_names": [
		"qbot-uses-windows-defender-antivirus-phishing-bait-to-infect-pcs"
	],
	"threat_actors": [],
	"ts_created_at": 1775434576,
	"ts_updated_at": 1775791288,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/2492a9b5aaa88b789b5511e40cc83bc129656b9d.pdf",
		"text": "https://archive.orkl.eu/2492a9b5aaa88b789b5511e40cc83bc129656b9d.txt",
		"img": "https://archive.orkl.eu/2492a9b5aaa88b789b5511e40cc83bc129656b9d.jpg"
	}
}