The emails prompt recipients to download what appears to be legitimate software installers for apps like LetsVPN or QQBrowser. Instead, they carry a multi-stage memory-resident loader known as Catena, ...