Template Injection

MITRE ATT&CK T1221 covers adversary creation or modification of references in user document templates so an application may retrieve remote content when a document is opened. This can conceal code or cause an authentication attempt; OOXML and RTF variants are included. A remote template fetch does not by itself prove that code executed. Spearphishing delivery is a separate behavior, and forced authentication is a possible variant rather than a required step.