This report details phishing email trends observed in March 2026, emphasizing the prevalence of trojans in attachment-based threats and a decline in phishing via fake pages. Script-based malware attacks using HTML and JavaScript increased notably. Attackers commonly used compressed files and document formats to distribute malware. Impersonation of courier and financial services was a key social engineering tactic. Malware families RemcosRAT and AgentTesla were identified, leveraging Telegram API tokens and external mail servers for command-and-control and data exfiltration. The report does not indicate any specific software vulnerabilities or exploits, nor does it reference patches or vendor advisories.

The impact involves increased phishing and malware campaigns that can lead to credential theft and unauthorized access through trojans and script-based malware. The use of trusted brand impersonation increases the likelihood of successful social engineering attacks. Data exfiltration via command-and-control infrastructure using Telegram API tokens and external mail servers can compromise sensitive information. There are no known exploits in the wild targeting specific software vulnerabilities, and no direct patch or remediation is applicable.

Since this report describes phishing and malware campaign trends rather than a specific software vulnerability, no direct patch or official fix is applicable. Organizations should focus on user awareness training to recognize phishing attempts, implement email filtering to detect malicious attachments and scripts, and monitor for indicators of compromise related to RemcosRAT and AgentTesla malware. Employing multi-factor authentication can reduce the risk of credential theft exploitation. No vendor advisory or patch information is provided; thus, patch status is not applicable.