The threat actor TA505 has begun distributing a new malware downloader known as AndroMut, the security firm Proofpoint claims, adding that this downloader pulls down a remote access trojan that it has called FlawedAmmyy.

The security firm Deep Instinct claims to have found a third variant of the ServHelper Windows malware that is being distributed by the threat actor TA505 and uses an Excel 4.0 macro Dropper, a legacy mechanism still supported by Microsoft Office, to spread.

Microsoft Excel has been giving scientists headaches for more than a decade, but nothing has been done to fix the issues which have been identified.