### Summary
Following successful phishing attempts, KeyBoy attackers leverage malicious macros embedded in Office documents to execute payloads on victim machines.

### Technical Details
- **Macro Behavior:**
  - Upon enabling, macros execute scripts to download additional payloads from attacker-controlled servers.
  - Leveraging PowerShell or VBA scripts to bypass security controls.

- **Indicators of Compromise (IOCs):**
  - Unusual network activity following document opening.
  - Creation of temporary files and execution of scripts without user consent.

### Mitigation Strategies
- **Disable Macros:** Default to disabling macros in Office files unless explicitly needed.
- **Endpoint Monitoring:** Employ behavior-based detection for suspicious script execution.