BlackOasis is using it to deliver the FinSpy commercial malware.

Phishing attack disguised as HMRC doc contains links to the infamous JRAT malware

Hackers brute forced scores of accounts

Double trouble for Android users, says ESET