Digital attackers used more than a dozen web servers to host 10 malware families and distributed those threats using phishing emails. Bromium researchers detected one of the servers hosting Dridex in March 2019. Threat actors subsequently used those web. servers to launch phishing attacks that relied on social engineering techniques. Hidden in those. documents were malicious Visual Basic for Applications (VBA) macros that, when enabled, loaded malicious payloads. In some cases, one malware family acted as a dropper of another threat.”]