LausivLoader Malspam: .r01 Archive with Supply Chain JS Lure

Ibrahim Saud@tektrix

•updated Sep 20, 2026•0•0•2

Detects incoming emails containing specific file extensions (.r01, .js) or subject lines/attachments related to a known supply chain lure campaign, where authentication protocols (SPF/DMARC) have failed. This combination of indicators is indicative of LausivLoader malspam delivery.