An AZORult infostealer campaign has been observed in the wild in which the attackers create fake Google Docs pages on Google Sites to use HTML smuggling to download malicious malware payloads. Netskope Threat Labs explained in a March 15 blog post that the AZORult infostealer payload then steals a user’s credentials and credit card information using a legitimate domain like Google Sites.

Source: SC Magazine