In the final Patch Tuesday release for 2021, the Redmond, Wash. software giant called special attention to CVE-2021-43890, a spoofing vulnerability in the Microsoft Windows AppX installer and warned that the bug is being exploited in the wild by the Emotet malware operation.

“Microsoft is aware of attacks that attempt to exploit this vulnerability by using specially crafted packages that include the malware family known as Emotet/Trickbot/Bazaloader,” the company said, warning that the bug allows an attacker to build malicious attachments for use in effective phishing campaigns.

The company credited Sophos researcher Andrew Brandt alongside its own Rick Cole and Nick Carr for reporting the zero-day flaw.