Many malspam campaigns have been seen since April passing off the LokiBot and NanoCore trojans. There are no targeted industries in these campaigns, but it simply seems as if threat actors are sending basic invoice emails with attached ISO disk image files to whomever they choose. The use of ISO files is a method used as a bypass of email security features since a lot of software will now automatically recognize and mount the image as soon as the email is clicked on. So far, around 10 variants of the campaign have been seen floating around and each seems to have slightly different forms of ISO images and messages. To add to the validity, signatures that appear to be from a real company have been added to the email. The most recent version of the LokiBot trojan is able to steal browsing information from over 25 different web browsers, check for the presence of web or email servers, grab credentials from 15 different email and file transfer clients, and search for popular remote admin tools like SSH, VNC, and RDP. As for the NanoCore trojan, it captures clipboard and monitoring keystrokes, collects information about document files on the system, and connects to FTP server to upload stolen data from the system.