Phishing Campaigns featuring Ursnif Trojan on the Rise | McAfee Blog

The initial attack vector is a phishing email with a Microsoft Word document attachment. Upon opening the document, VBA executes a malicious shellcode. Shellcode downloads the remote payload, Ursnif, and invokes rundll32.exe to execute it.