OLEOutlook: Bypass Almost Every Corporate Security Control with a GUI
tl;dr using an old but still valid OLE component, you can embed any exe in a word doc, convert to rich text, that then faithfully re-expands the exe onto users runtime when they open the word doc - a perfect malware delivery method that if correct has almost no defence beyond ... Plain text emails.<p>(The firewall would need to re-expand the rich text using this OLE, then scan the word doc, then repackage.  Unsurprisingly nothing on market seems to.  Jeez - stick to plain text)<p>One suspects that a lot of spear-phisers know about this already.