Recently, Microsoft pushed an update to their Office platforms to automatically block macros when opening a document or spreadsheet. Since this update, threat actors have been attempting to find new ways to compromise assets without the use of Office macro-enabled documents. According to statistics from Proofpoint, the use of macro-enabled malicious attachments in social engineering campaigns is down roughly 66% since the update. However, some new methods of compromise have surfaced throughout the threat landscape. Rather than macro-enabled documents, threat actors are shifting to using Windows image files (ISO), RAR archives (RAR), and Windows Shortcut files (LNK) as the deployed malicious file in social engineering campaigns. A recent campaign targeting Korean users displayed the use of these new tactics. Threat actors launched a phishing campaign containing invoice-themed emails with an attached ISO file. Once the ISO file is opened on the user’s system, a LNK file collects device hardware information and executes a malicious dynamic link library (DLL). With the ever-changing threat landscape, threat actors will continue to find new innovative methods to compromise assets even in the face of new security protocols.