Introduction Until recently , I had n't personally seen much malicious spam ( malspam ) using Microsoft office documents with Hancitor-based Visual Basic ( VB ) macros to send Pony and Vawtrak . Occasionally , I 'll find a report like this one from 2016-12-19 , where Hancitor/Pony/Vawtrak malspam was disguised Attack.Phishing as a LogMeIn account notification , but I rarely come across an example on my own . And apparently , there 's been a recent lull Attack.Phishing in Hancitor/Pony/Vawtrak malspam until yesterday .