The volume of weaponized Office document malware deliveries far outpaced other threats from malvertising, ransomware and other crime ware Trojans combined. Invincea said it detected and stopped hundreds of these advanced attacks that involve numerous malware families and bypass all other security controls.

Invincea also discovered Shifu attacks, which installed fully functional versions of the Apache web server via infected weaponized Office documents. Observers suspected this version of Apache intercepted and interpreted SSL transactions within online banking applications to easily compromise banking credentials.

“The Shifu banking Trojan is a Frankenstein's monster of malware techniques cobbled together from prior banking Trojans,” Belcher claimed.

According to IBM, this Trojan is capable of stealing cryptocurrency and smartcard credentials, disabling legacy anti-virus tools and even patching vulnerable applications against future exploit attempts.

In another ploy, business websites that typically run slideshow plug-ins were utilized to redirect visitors to exploit kits that delivered crippling CryptoWall3 ransomware. While CryptoWall spreads by infecting websites indiscriminately, Invincea noticed regional attack trends: They targeted India through poisoned phone number directories and Saudi Arabia via a popular online news source.

Invincea also discovered while malvertising instances dropped overall, there were some major attacks in October that potentially affected tens of thousands of users in Germany and Poland. For example, Germany's largest Internet service provider, T-Online.de, inadvertently ran advertisements for almost a week that dropped a banking rootkit called Tinba and a click-fraud bot called Bedep.