1534
If the user has disabled Protected View , the exploit executes automatically , making an HTTP request to the attacker 's server , from where it downloads an HTA ( HTML application ) file , disguised as an RTF .
 phishing: disguised as
Please tell me event type and its trigger word from given type options. Output format is "type: trigger".  Option: phishing, data breach, ransom, discover vulnerability, patch vulnerability 
Text: {0} 
Answer:
 phishing: disguised as