The legitimate remote-access tool is being used to maliciously infect victims and allow remote code-execution. The legitimate remote access tool (RAT) called NetSupport Manager, used for ...

These include NetSupport Manager, a legitimate remote administration tool, which is frequently repurposed in cyber-attacks. Similar techniques have been used by groups such as FIN7 and STORM-0408, ...

If a victim enables it, the macro is downloaded and the NetSupport Manager RAT is executed. The emails purport to come from Johns Hopkins Center bearing "WHO COVID-19 SITUATION REPORT".