> A phishing email which can pwn you without user interaction is basically unheard of. If you extend from "email" to the other communication tools that compani

> A phishing email which can pwn you without user interaction is basically unheard of. If you extend from "email" to the other communication tools that companies use today (and do use for inter-company communications too), there actually have been a number of these in the past year. Outlook [3] had one that didn't require downloading the file, exactly - the "Preview" window from just clicking the attachment once, was enough. Microsoft Teams [0], Jabber [1] and Slack [2] were all hit by real 0-interaction RCEs. [0] https://github.com/oskarsve/ms-teams-rce/blob/main/README.md https://github.com/oskarsve/ms-teams-rce/blob/main/README.md [1] https://nvd.nist.gov/vuln/detail/CVE-2020-3495 https://nvd.nist.gov/vuln/detail/CVE-2020-3495 [2] https://hackerone.com/reports/783877 https://hackerone.com/reports/783877 [3] https://nvd.nist.gov/vuln/detail/CVE-2020-1349 https://nvd.nist.gov/vuln/detail/CVE-2020-1349