Back Gbhackers

RFQ Malware Campaign Uses DOCX, RTF, JS, and Python

Gbhackers •Mayura Kathir • April 2, 2026

Hackers are abusing DOCX, RTF, JavaScript, PowerShell, and Python to deliver an in‑memory Cobalt Strike beacon in a stealthy spear‑phishing campaign that impersonates Boeing procurement under the tag NKFZ5966PURCHASE. The operation chains six stages, relies heavily on living‑off‑the‑land binaries, and reuses the same encryption keys across all known samples, creating both strong evasion and clear […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Boeing RFQ Malware Campaign Exploits DOCX, RTF, JS, and Python A sophisticated malware campaign, tracked as NKFZ5966PURCHASE, is targeting industrial suppliers and procurement teams by impersonating Boeing in procurement emails. The attack utilizes DOCX, RTF, JavaScript, PowerShell, and Python to deliver an in-memory Cobalt Strike beacon through a six-stage process. Victims are lured into opening a malicious Word document disguised as a Request for Quotation from a fake sender named Joyce Malave. This campaign leverages living-off-the-land binaries and reuses encryption keys across samples, enhancing its evasion capabilities. The exact number of affected organizations is currently unknown, but the operation poses a significant threat to supply chain security. As of now, the campaign is active and ongoing, with security professionals urged to remain vigilant. 2 sources 67

Extracted Entities

RFQ Malware Campaign Uses DOCX, RTF, JS, and Python

The full story

Extracted Entities

Attack Types (2)

Campaigns (1)

Malware (1)

MITRE ATT&CK (4)

Tools (1)