The campaign sends phishing emails pretending to be from Meta, Instagram’s parent company, claiming that the recipient’s account has been restricted due to copyright infringement.
The malware is being distributed through emails pretending to be from an IRS employee, with recipients unknowingly downloading the QakBot DLL when attempting to view a PDF attachment.