Pivoting on a malspam infrastructure delivering JS malware backed by bulletproof networks

A financially motivated threat actor conducted widespread malspam campaigns in March 2026, targeting global energy and finance sectors with obfuscated JavaScript backdoors delivered via phishing emails, all enabled by resilient bulletproof hosting networks linked to notorious cybercrime infrastructure providers.