The recent instances we have observed were spread through emails with malicious links. Clicking the link leads to the download of a zip containing a VBS file (detected as Trojan.VBS.QAKBOT.SM) that then downloads a malicious executable file (detected by Trend Micro as Backdoor.Win32.QBOT.SMTH