A live malware infection - a real life study (Part 1)

We recently assisted a client that was aggressively hit with a phishing campaign. Following a couple of successful compromises they found themselves faced with an escalation with the malware attempting to impersonate staff, both emailing their customers and pivoting to attack the admin users in a secondary phishing attack. What made things a little more interesting than the usual kiddy attack was that the initial malware was not carrying a particularly nefarious payload, which meant that it escaped the usual malware detection that the client had deployed.