It has used DOCX files to download malicious DOT document templates and has used RTF template injection to download malicious payloads. It can also inject malicious macros or remote templates into documents already present on compromised systems.