Stolen Images Evidence Campaign Continues Pushing BazarLoader Malware

Downloaded zip archives The downloaded zip archives are always named Stolen Images Evidence.zip. They contain a JavaScript file named Stolen Images Evidence.js. BazarLoader from the JS file. If a victim double-clicks the extracted JavaScript file on a vulnerable Windows host, it retrieves and runs a DLL for BazarLoader malware. The DLL is saved to the infected user's AppDataLocalTemp directory with a .dat file extension.