Phishing with Microsoft Office

This Office-specific example of MITRE T1566.001 delivers a malicious Microsoft Office document as an email attachment to gain initial access. After a recipient opens the attachment, its payload may execute directly or exploit an application vulnerability; the outcome depends on application protections and policy. VBA macros in Office files marked as coming from the Internet are blocked by default in applicable Office deployments, though behavior depends on file origin, version, trusted locations or publishers, and organizational policy. Link-based phishing is a separate sub-technique, and credential collection is not inherent to attachment delivery.