Since 2022, attackers have installed infostealers and commodity malware remote access Trojans (RATs) such as Remcos, Formbook and AgentTesla using the DbatLoader (also known as ModiLoader). It spreads usually through phishing email carrying a malicious attachment.