Trickbot is being spread via seasonally-themed spam emails that use tax-incentive lures purporting to be from Deloitte. The emails promise help for getting the most out of this year s changes to the U.S. tax code. Yet attached is a macro-enabled Microsoft Excel spreadsheet, which once activated, will download Trickbot’s computer. Trickbot can now steal credentials from the Virtual Network Computing (VNC), PuTTY and Remote Desktop Protocol (RDP) platforms.
Source: https://threatpost.com/trickbot-remote-desktop/141879/