Click to Enable Content

A security research/red-team blog describing a technique for delivering an obfuscated PowerShell backdoor via a macro-enabled PowerPoint (Veil-Evasion + macro_safe.py) that establishes a reverse TCP C2 over port 443; the post demonstrates that common AV and mail scanners did not detect the malicious document and highlights user behavior (clicking through macro warnings) as the primary enabler for successful compromise.