PLEAD’s installers are disguised as documents using the right-to-left-override (RTLO) technique to obfuscate the malware’s filename. They are mostly accompanied by decoy documents to further trick users. We’ve also seen PLEAD use exploits for these vulnerabilities:. .