> Half the steps in this graph would work for macOS or Linux as well if they're set up for corporate environments. Most of it is browsers and office application

> Half the steps in this graph would work for macOS or Linux as well if they're set up for corporate environments. Most of it is browsers and office applications just doing their thing. Notice how none of these include code actually executable in an operating context until the very end, when the very last sandbox has been escaped and a script downloads the actual payload from a position where it would be able to set the executable bit anyway. Yes indeed, but this logical and thought out explanation is no match for a limited-characters hot take (plus an image!) on Twitter. That's "information" now.