The attacks are triggered by visiting a website with the malicious code.”
(this could be a well known, sincere, but hacked website)
“By downloading, the malware can install itself on the target device.”
“HTML smuggling is also made possible by the HTML5 “Download” attribute for anchor tags.”
“When a user clicks the HTML link, a download of the file is triggered.”
“The attack occurs especially in email campaigns.”
“That is, users with Exchange Online mailboxes are also affected.”
“Spear phishing campaign can ransomware”
“This technique was noticed in a spear phishing campaign in May 2021.
“Ransomware also enters networks in this way.”
“The Microsoft 365 Defender Threat Intelligence Team shows what such an attack looks like in a Twitter post.