Jake Williams on Twitter: "Okay, so playing the #msdt 0-day a bit and here's what's happening: 1. The maldoc contains a linked HTML document 2. Word automatically retrieves the linked HTML document, which contains JS to reset the location to an ms-msdt protocol handler, which is present by default 1/ https://t.co/aJ1KenTvf1" / Twitter
https://twitter.com/MalwareJake/status/1531019243411623939