Proofpoint Threat Research recently identified a campaign with emails from various senders that included subjects such as “RFQ”. They contained a OneDrive URL that triggered the download of a VHD when clicked. The campaign began on 1/17 and continued through 1/18 to include over 1,300 messages.
