AhnLab ASEC detailed a CHM malware wave impersonating Korean financial institutions and insurance companies, timed around regular payment-statement schedules to increase the chance of execution. The CHM ran through hh.exe, decompiled content into C:\Users\Public\Libraries, executed Docs.jse with wscript, and used PowerShell to download and start an Infostealer payload. AhnLab EDR telemetry showed persistence via a registry autorun entry, follow-on cmd and script execution, and an alg.exe infostealer collecting user PC, directory, and browser information. The stolen data was compressed under Public\Pictures and transmitted to the attacker’s server, with related download infrastructure including tosals[.]ink, frotsy[.]lol, drilts[.]sbs, and crilts[.]cfd.