This intelligence analysis covers a malicious campaign deploying Remcos RAT, a commercially available remote access trojan. The infection starts with a weaponized Excel spreadsheet that uses VBA macros to execute PowerShell commands, which then download additional malicious scripts from attacker-controlled domains. The multi-stage attack culminates in the deployment of the Remcos RAT payload. The campaign uses social engineering with financial-themed lures to trick victims into enabling macros, facilitating the infection. Command and control infrastructure involves domains dvrlists[.]com and lbl[.]support.