Morocco Cybersecurity Alert: PowerPoint Malware Targets Users

Users of this software must be extra vigilant, the Administration said in a security bulletin, noting that "several phishing campaigns are using malicious ’PowerPoint’ documents to distribute various types of malware, including remote access Trojans and information theft. Cyber attackers are using ’PowerPoint’ files combined with legitimate cloud services that host malware payloads."

Among these malicious software, "Warzone" (alias AveMaria) and "AgentTesla", two powerful Remote Access Tools (RATs), are cited, which can steal browser passwords, record keyboard strokes, steal clipboard content, etc.

To address this, the department stressed that "users must be made aware and only open documents from legitimate sources".