Procedure examples

Bisonal has relied on users to execute malicious file attachments delivered via spearphishing emails.

Lumma Stealer has gained initial execution through victims opening malicious executable files embedded in zip archives, and MSI files within RAR files.

Clambling has gained execution through luring victims into opening malicious files.

DarkGate initial infection payloads can masquerade as pirated media content requiring user interaction for code execution. DarkGate is distributed through phishing links to VBS or MSI objects requiring user interaction for execution.

Mongall has relied on a user opening a malicious document for execution.

SVCReady has relied on users clicking a malicious attachment delivered through spearphishing.

Latrodectus has lured users into opening malicious email attachments for execution.

Saint Bot has relied on users to execute a malicious attachment delivered via spearphishing.

Chaes requires the user to click on the malicious Word document to execute the next part of the attack.

LODEINFO has been executed via victims opening malicious email attachments.

A Word document delivering TYPEFRAME prompts the user to enable macro execution.

Bundlore has attempted to get users to execute a malicious .app file that looks like a Flash Player update.

Metamorfo requires the user to double-click the executable to run the malicious HTA file or to download a malicious installer.

Bandook has used lure documents to convince the user to enable macros.

KONNI has relied on a victim to enable malicious macros within an attachment delivered via email.

DnsSystem has lured victims into opening macro-enabled Word documents for execution.

KGH_SPY has been spread through Word documents containing malicious macros.

Kerrdown has gained execution through victims opening malicious files.

RedLine Stealer malware has been executed through the download of malicious files. RedLine Stealer has also lured users to install malware with an Install Wizard interface.

Black Basta has been downloaded and executed from malicious Excel files.

SQLRat relies on users clicking on an embedded image to execute the scripts.

RTM has relied on users opening malicious email attachments, decompressing the attached archive, and double-clicking the executable within.

StrelaStealer relies on user execution of a malicious file for installation.

Grandoreiro has infected victims via malicious attachments.

ZxxZ has relied on victims to open a malicious attachment delivered via email.

Some SUGARDUMP variants required a user to enable a macro within a malicious .xls file for execution.

LunarMail has been installed through a malicious macro in a Microsoft Word document.

JCry has achieved execution by luring users to click on a file that appeared to be an Adobe Flash Player update installer.

REvil has been executed via malicious MS Word e-mail attachments.

Valak has been executed via Microsoft Word documents containing malicious macros.

Taidoor has relied upon a victim to click on a malicious email attachment.

NativeZone can display an RTF document to the user to enable execution of Cobalt Strike stage shellcode.

PLEAD has been executed via malicious e-mail attachments.

Cardinal RAT lures victims into executing malicious macros embedded within Microsoft Excel documents.

DanBot has relied on victims' opening a malicious file for initial execution.

Ramsay has been executed through malicious e-mail attachments.

AshTag has been executed through victims downloading and opening malicious RAR archive files.

OutSteel has relied on a user to execute a malicious attachment delivered via spearphishing.

BoomBox has gained execution through user interaction with a malicious file.

LAMEHUG has been executed through victim interaction with malicious email attachments made to look like legitimate AI applications or documents.

Mango has been executed through a Microsoft Word document with a malicious macro.

Lokibot has tricked recipients into enabling malicious macros by getting victims to click "enable content" in email attachments.

PoetRAT has used spearphishing attachments to infect victims.

HIUPAN has lured victims into executing malicious files from USBs including the use of files such as USBconfig.exe.

KOCTOPUS has relied on victims clicking a malicious document for execution.

Heyoka Backdoor has been spread through malicious document lures.

Disco has been executed through inducing user interaction with malicious .zip and .msi files.

Octopus has relied upon users clicking on a malicious attachment delivered through spearphishing.

Qilin has been delivered to victims through spearphishing emails with malicious attachments.

AppleJeus has required user execution of a malicious MSI installer.