Upon opening the attachment in the phishing email, a macro is executed, serving as the initial payload to establish a foothold within the system. The macro downloaded additional malicious payloads that attempt to communicate with a known malicious IP.