EIP-2026-103985

The exploit leverages a spoofing vulnerability in Microsoft OneNote by embedding a VBA macro that executes a command to download and run a malicious script. The script deletes files in the user's IMPORTANT directory, demonstrating arbitrary code execution via a crafted OneNote file.