Do Son Imperial Kitten uses Microsoft Excel documents with embedded macros to activate the infection and install a Python shell
Crimson Sandstorm
IMAPLoader is a .NET-based malware designed to identify victim systems using standard Windows utilities. It operates as a loader