Payloads are now hosted on compromised websites. The payloads hosted on these websites consist of seemingly benign BMP image files. The malicious macros download the images and the ObliqueRAT payload is extracted to disk. The ObliqueRAT payload is renamed with the .pif file extension