Executable
Phishing
Doubleclick
Contributors:
Adithya - @ravooriadithya
Description:
A PPAM file is a PowerPoint macro-enabled Open XML add-in file used by Microsoft PowerPoint, a program used to develop slide show presentations. This file type was introduced in 2007 with the release of Microsoft Office 2007. It contains components that add additional functionality, including extra commands, custom macros, and new tools for extending default PowerPoint functions.
PPAM files are found to be misused by various threat actors which include cyber crime where Agent tesla has been found to be leveraging these types more often
OS:
Windows
Mac
Recommendation:
Block PPAM extensions over Email and Web Proxies
Resources:
File Samples: