delivr.to started a ‘Top 10’ of its payloads that use new or notable delivery techniques, each rebuilt from a sample that threat actors or researchers used. QakBot dominates the first edition: PDFs with a download button, HTML smuggling of a zipped ISO, and HTA and WSF scripts padded with decoy text, which inflates the file size and likely lowers detection rates. OneNote shows up twice, once with a BAT file that decrypts and loads a .NET assembly, once with a right-to-left override character that dresses up an HTA as another .one file. Also on the list: XHTML smuggling, a fake SharePoint login page, .URL shortcuts and ICS invites with embedded files, and CVE-2023-23397, the Outlook reminder sound fetched from a UNC path. Most entries come with YARA or Sublime rules for detection.
