>but never saw it on onedrive. I have. It hasn't been what you suggest. You're not wrong you could host somewhere encrypted and escape detection. But that mea

>but never saw it on onedrive. I have. It hasn't been what you suggest. You're not wrong you could host somewhere encrypted and escape detection. But that means you still need to point to a scam site to execute the package. But the way this works is that you're sent an email with a legit Microsoft domain. Sometimes even a legit Microsoft Share email that points to a onedrive stored file. The whole point is that your payload is hosted on a legit service that Apple, Dropbox, Microsoft, etc really do own. So that if you're trained to look at the URL, you see something legit, not share.filez-mikrozoft.kom I've had to instruct my employees to look at the context, not just the hosting link. Do you know this person? Where you expecting a file? If you aren't sure can you contact them via some other form than email?