A phishing campaign is distributing Trojanized MSI files that use DLL sideloading to execute LegionLoader, a malicious program that delivers multiple infostealers. The campaign is widespread, with over 400 unique malicious MSI files identified since June 2024. Victims are targeted globally through links from .monster domains forwarded to cloud providers. The attack chain involves downloading a ZIP file containing a malicious MSI, which retrieves a password from a C2 server to unpack a RAR file and extract a malicious DLL. LegionLoader then downloads various infostealers and communicates with multiple domains. The infrastructure heavily utilizes Cloudflare, making tracing difficult. Mitigation involves sourcing software from legitimate sources, keeping systems updated, and using reputable antivirus software.