Security+ 801 Countdown, T-31: Threat Vectors Rebuilt for RCS, QR Codes, and Fake CAPTCHAs

A threat vector is the path an attacker uses to reach a target: the channel that carries a lure, a file, or an exploit from the adversary to a victim’s device, account, or network. A threat source is the adversary at the other end of that path. Defenders keep the two ideas separate because controls attach to channels. Mail filtering sits on the email vector, an AutoPlay setting sits on the removable media vector, and a firewall rule sits on the remote access vector, so knowing which channel delivered a payload tells a responder which control was bypassed and which one to check next.

SY0-801 objective 2.3, “Describe threat vectors and sources,” expands the vector list with named sub-bullets for the channels that show up in current incident reports: Rich Communication Services (RCS) and collaboration tools, QR codes and fake CAPTCHAs, macro, RTF, and PDF attachments, malicious USB devices, remote access services, edge appliances and hypervisors, and SaaS and logistic providers (CompTIA 2025). The objective is built as one source, the advanced persistent threat (APT), followed by vector categories named for their channel: message-based, image-based, attachment-based, external media-based, remote access, network-based, and supply chain-based, among others. Describing a vector on this exam means naming the channel and the trust it abuses. Browser-based, endpoint-based, IoT, OT, physical, and signal-based vectors have their own posts (T-28, T-30, T-22, and T-26), and the human-based lures are covered at T-27.

Sources versus vectors: the advanced persistent threat

The objective title pairs vectors with sources, and the APT is the only source on the list. NIST SP 800-30 Rev. 1 defines an APT as an adversary with “sophisticated levels of expertise and significant resources” that uses multiple attack vectors and pursues its objectives “repeatedly over an extended period of time” (NIST, n.d.). The definition has three parts worth holding apart: capability (expertise and resources), breadth (multiple vectors rather than one), and persistence (an extended period rather than a single intrusion). Basically, a vector answers how the payload arrived; the APT answers who sent it and how long they intend to stay.

That distinction is what a scenario tests. A stem that stresses months of undetected access, a custom implant on an edge appliance, or an adversary that returns through a second channel after the first is closed is pointing at APT as the source, even though each individual entry used an ordinary vector such as a VPN appliance or a phishing message. The actor label for that adversary is usually State-sponsored, which belongs to T-32.

Message-based vectors: RCS and collaboration tools

A message-based vector delivers the lure through a conversation channel the victim already uses: email, SMS, instant messaging, RCS, or a workplace collaboration tool. The attacker’s problem on any of these channels is the filter between sender and reader, and the two newest sub-bullets matter precisely because of where that filter is missing.

RCS is “a carrier-provided service,” and GSMA positions its Universal Profile as the successor to SMS; the current specification is Universal Profile 4.1, published July 28, 2026 (Apple 2026; Van Pelt 2026). Where SMS moves short plain-text messages through the carrier, RCS moves richer messaging through the same carrier relationship, and it is now getting the encryption that SMS never had. GSMA announced end-to-end encryption based on the Messaging Layer Security (MLS) protocol on March 14, 2025, and Apple’s iOS 26.5 labels cross-platform encrypted RCS “Beta,” available “with supported carriers” (GSMA 2025; Apple 2026).

For defenders, encryption cuts the other way. A carrier SMS firewall works by reading message content and dropping known lure patterns and malicious URLs; an end-to-end encrypted channel removes that inspection point entirely. Netcraft documented the darcula phishing kit sending lures over RCS and iMessage instead of SMS, which bypasses carrier SMS firewalls because operators cannot inspect encrypted content; it counted more than 20,000 darcula domains targeting 100+ brands (Everett 2024). The postal-delivery lure text is the same smish a user has seen before; what changed is that the filter in front of it is gone.

Collaboration tools abuse a different trust: the internal-feeling chat window. A chat that opens inside Microsoft Teams looks like it came from a colleague, but Teams external access defaults to “Allow all external domains,” so any Microsoft 365 tenant that also allows external access can start a chat (Microsoft 2026b). A tenant is an organization’s own Microsoft 365 instance, and the display name an incoming chat shows is the one the sending tenant chose. Microsoft reported Storm-1811, a Black Basta affiliate, creating tenants with display names such as “Help Desk IT” and “IT Support,” then talking victims into Quick Assist sessions; Teams use was observed at the end of May 2024. Microsoft’s user-level mitigation is to check the “External” tag (Microsoft Threat Intelligence 2024a). The vector is the chat; the remote-assistance session is the next stage, not the delivery channel.

Image-based vectors: QR codes, embedded content, and fake CAPTCHAs

An image-based vector hides the malicious element inside something the user, or the filter, treats as a picture. The objective names three forms: QR codes, embedded content, and CAPTCHA.

A QR code is a two-dimensional barcode that encodes data, usually a URL, so a phone camera can open the link with no typing. That convenience is the attack: QR codes carry a URL past text-based link scanning, because a mail filter that extracts and checks URLs from a message body finds nothing when the link exists only as pixels until a camera decodes it. The quishing mechanics, i.e., what happens after the scan, are T-27’s.

“Embedded content” has no CompTIA definition; the likely meaning, an interpretation, is a payload hidden inside a benign-looking file, as in ATT&CK T1027.017 SVG Smuggling (script inside an SVG image) and T1027.006 HTML Smuggling (MITRE 2025c). An SVG is a text-based image format, so a file that a filter classifies as an image can carry script that the browser runs when it renders the picture; the image is the wrapper, and the content is the payload.

CAPTCHA appears in two roles. A CAPTCHA is a challenge designed to tell a human from an automated client, and attackers use both the human’s trust in it and the robot’s inability to pass it. As a lure, it is ClickFix, ATT&CK T1204.004 Malicious Copy and Paste: a fake “verify you are human” page tells the user to open the Run dialog and paste a “verification” string that page script already placed on the clipboard (MITRE 2025a). Microsoft first observed the technique between March and June 2024, and its most prolific final payload is Lumma Stealer (Microsoft Threat Intelligence 2025). As a wrapper, a Cloudflare Turnstile gate in front of a credential page keeps automated anti-phishing scanners from reaching the form (Check Point 2023). What a responder sees after a ClickFix click:

Lure (rendered page):  "Verify you are human"  [ ] I'm not a robot
                       1. Press Windows+R   2. Press Ctrl+V   3. Press Enter
Clipboard source:      navigator.clipboard.writeText(...)  (page script)
Run dialog owner:      explorer.exe
Child process:         powershell.exe  (most-used binary per Microsoft)
Artifact on host:      HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU
                       (value holds the pasted string)
Mitigations:           GPO "Remove Run menu from Start Menu";
                       PowerShell script block logging;
                       Windows Terminal multi-line paste warning

Because the user runs the command, email filtering, browser sandboxing, and controls on downloaded files never see a file. The browser was only the display surface for the instructions, which is why the vector is image-based rather than browser-based. Detection by parent-child process chain belongs to T-30; here, recognize the vector.

Attachment-based and external media vectors: three file carriers and a keyboard

An attachment-based vector delivers a file that carries its own execution mechanism, so opening it is enough to start the payload. The objective names three carriers, each with a distinct payload mechanism and a triage tell.

Carrier	Payload mechanism	Triage tell
Embedded macros	VBA auto-exec procedures such as Document_Open	olevba flags AutoExec plus Suspicious keywords
RTF documents	OLE objects, e.g., Equation Editor exploit CVE-2017-11882	rtfobj flags the Equation 3.0 CLSID
PDFs	JavaScript run by an automatic action	pdfid counts /JS and /OpenAction or /AA

A macro is code stored inside a document that runs inside the application that opens it; in Office that code is Visual Basic for Applications (VBA), and auto-exec procedures such as Document_Open run as soon as the file opens. Office blocks VBA macros in files from the internet by default (Current Channel version 2206, July 27, 2022). The block keys on Mark of the Web, the NTFS Zone.Identifier stream with ZoneId=3 that records a downloaded file as having come from the internet zone, and it applies only to Office on Windows, which is the trap: candidates over-generalize “macros are off” (Microsoft 2026a). A document opened in Office on a platform other than Windows, or one that reaches disk without the mark, gets no block.

An RTF document carries its payload as an embedded OLE object, and the classic case is the Equation Editor exploit CVE-2017-11882, a stack buffer overflow in eqnedt32.exe, which ran as a separate COM server without ASLR, so Office’s own mitigations missed it; Microsoft removed Equation Editor 3.0 in January 2018 (CERT/CC 2017). A PDF carries JavaScript that an automatic action runs when the document opens, and a one-page PDF with JavaScript and an /OpenAction is the classic malicious pattern: the content gives no reason for code to run on open.

“Malicious USB,” the external media-based sub-bullet, has two sub-cases. Autorun malware on storage is stopped by disabling AutoPlay. A keystroke-injection device is different: it is a USB device that enumerates as a keyboard and types commands, and the operating system trusts a keyboard. FIN7 mailed USB sticks disguised as HHS letters and Amazon gift boxes that would “register itself as a keyboard” and type PowerShell commands (Cimpanu 2022). ATT&CK tracks this as T1674 Input Injection (MITRE 2025b). Because the operating system trusts a keyboard, autorun and USB-storage blocks do not stop it; device-installation restrictions by device class or ID, and physical port control, do.

Remote access, edge devices, hypervisors, and providers

The last group of vectors reaches the target without a user at all. Remote access names three services. Remote desktop, RDP, listens on TCP 3389. VNC uses the Remote Framebuffer protocol on TCP 5900; RFC 6143 defines security type 1, None, and a DES challenge-response that truncates the password to eight characters, and its Section 9 says the protocol “provides no security beyond the optional and cryptographically weak password check” (Richardson and Levine 2011). A check against a documentation address shows what an attacker learns:

$ nmap -p 5900 --script vnc-info 198.51.100.10
PORT     STATE SERVICE
5900/tcp open  vnc
| vnc-info:
|   Protocol version: 3.8
|   Security types:
|     None (1)
|_  WARNING: Server does not require authentication

The VPN sub-bullet is the appliance itself, not the tunnel. Network-based “Infrastructure devices” and “Virtualized devices” share the reason they are prized: Mandiant reports firewalls, VPNs, and virtualization platforms “rarely support EDR deployment,” and their exploits “typically require no user interaction” (Mandiant 2024). An edge appliance sits at the network boundary with a public listener, runs a vendor operating system that rarely accepts an endpoint agent, and holds the sessions of everyone who connects through it. Citrix Bleed, CVE-2023-4966, leaked memory containing valid session cookies from NetScaler appliances, letting LockBit affiliates bypass passwords and MFA; CISA’s fix included killing active sessions as well as patching, because a patch does not invalidate a cookie that was already stolen (CISA 2023). CISA Emergency Directive 24-01, issued January 19, 2024, addressed Ivanti Connect Secure flaws CVE-2023-46805 and CVE-2024-21887 (CISA 2024). A hypervisor is the layer that hosts many virtual machines on one physical server, which makes it the highest-yield target on the list: ESXi CVE-2024-37085 granted full admin to an Active Directory group named “ESX Admins,” and ransomware operators then encrypted the datastore, every hosted VM at once (Microsoft Threat Intelligence 2024b). Session keys, the third network-based sub-bullet, are T-28’s.

Supply chain-based vectors reach the target through a third party that already has access. A managed service provider (MSP) runs IT for many customers through a shared remote-management tool, so one compromise fans out downstream: Kaseya VSA (July 2021) is the MSP case, in which one remote-management tool delivered ransomware to many downstream customers (CISA 2021). A SaaS provider holds an integration token rather than a management agent, and the token is enough: UNC6395 in August 2025 used stolen OAuth tokens for the Salesloft Drift app to export Salesforce data, and Google says the activity did not stem from “a vulnerability within the core Salesforce platform” (Larsen et al. 2025). The victim’s own platform was not broken; a partner’s credential to it was. “Logistic providers” has no CompTIA definition; the likely meaning (an interpretation) is shipping, fulfillment, and delivery partners with facility or system access.

What you need to know for SY0-801

• APT is a source (who, how persistent); everything else in 2.3 is a vector (how delivered).
• Vector is 2.3, the exposure is 2.4, the observed attack is 2.5: the QR code is a 2.3 image-based vector, quishing is a 2.5 attack.
• RCS is carrier-provided and SMS’s successor; its cross-platform encryption is new, beta, and carrier-dependent, and it hides lures from SMS filtering.
• A chat from an outside tenant named “Help Desk” is Message-based, Collaboration tools; the “External” tag is the user-level tell.
• A page saying Win+R, Ctrl+V, Enter is Image-based, CAPTCHA (ClickFix), not Browser-based; no file is ever downloaded.
• Macro blocking needs Mark of the Web and Windows Office; RTF hides OLE exploits; PDFs hide JavaScript.
• Disabling autorun does not stop a USB device that enumerates as a keyboard; device-installation restrictions and port control do.
• RDP is TCP 3389; VNC is TCP 5900 and may allow no authentication at all.
• Edge appliances and hypervisors rarely support EDR, and one compromise reaches many hosts.
• Supply chain-based covers MSPs, SaaS providers, and logistic providers; a stolen partner OAuth token is a supply chain vector.
• Voice call, Default credentials, and Client-based vs. agentless are 701-era vectors with no 801 entry; vishing lives in 2.5.
• “Embedded content” and “Logistic providers” have no CompTIA definition.

Check yourself

These are my own practice questions, written for this post.

1. An employee visits a site showing a CAPTCHA that instructs, “Press Windows+R, then Ctrl+V, then Enter to verify.” Minutes later, EDR shows explorer.exe launching powershell.exe. Which SY0-801 2.3 vector best describes the delivery?

• A. Browser-based.
• B. Image-based.
• C. Attachment-based.
• D. Human-based.

Answer: B. CAPTCHA is an Image-based sub-bullet in 801, and the fake verification page is the ClickFix lure. No file was attached, and the browser was only the display surface.

2. A finance analyst receives a Microsoft Teams chat from an outside tenant named “IT Support” asking her to approve a remote-assistance session. Which classification fits the delivery channel best?

• A. Remote access.
• B. Supply chain-based.
• C. Message-based, collaboration tools.
• D. Default credentials.

Answer: C. The lure arrived as a chat from an external tenant, which is the Collaboration tools sub-bullet. Default credentials is not an 801 vector, and the remote session is what the attacker wants, not how the lure arrived.

3. A penetration tester finds TCP 5900 open on a server; the scan reports the security type None and that the server does not require authentication. Which sub-bullet applies, and why is it severe?

• A. Remote access, VNC; RFC 6143 permits a None security type, so anyone can control the desktop.
• B. Remote access, Remote desktop; port 5900 is RDP’s default.
• C. Network-based, Infrastructure devices; the server is an edge appliance.
• D. Remote access, VPN; port 5900 carries tunnel traffic.

Answer: A. Port 5900 is VNC, and security type None means no password is checked. RDP uses TCP 3389.

This is T-31 of the Security+ 801 Countdown: one change from SY0-701 to SY0-801 every morning until the new exam launches on November 17, 2026. Tomorrow, T-30: Living off the Land and Fileless Malware Arrive. New here? Start with T-38: The Blueprint Was Reweighted and Trimmed to 27 Objectives.

References

Apple. 2026. “What Is the Difference Between iMessage, RCS, and SMS/MMS?” Apple Support. Accessed October 12, 2026.

CERT/CC. 2017. “VU#421280: Microsoft Office Equation Editor Stack Buffer Overflow.” CERT Coordination Center.

Check Point. 2023. “Verify You Are Human (So We Can Steal Your Credentials).” Check Point Blog, August 15, 2023.

Cimpanu, Catalin. 2022. “FBI: FIN7 Hackers Target US Companies with BadUSB Devices to Install Ransomware.” The Record, January 7, 2022.

CISA. 2021. “CISA-FBI Guidance for MSPs and Their Customers Affected by the Kaseya VSA Supply-Chain Ransomware Attack.” Last revised July 6, 2021.

CISA. 2023. “#StopRansomware: LockBit 3.0 Ransomware Affiliates Exploit CVE 2023-4966 Citrix Bleed Vulnerability.” Cybersecurity Advisory AA23-325A, November 21, 2023.

CISA. 2024. “ED 24-01: Mitigate Ivanti Connect Secure and Ivanti Policy Secure Vulnerabilities.” Emergency Directive, January 19, 2024.

CompTIA. 2023. CompTIA Security+ SY0-701 Certification Exam Objectives. Version 5.0.

CompTIA. 2025. CompTIA Security+ SY0-801 V8 Certification Exam Objectives. Document Version 2.0.

Everett, Harry. 2024. “Out of the Shadows: ‘darcula’ iMessage and RCS Smishing Attacks Target USPS and Global Postal Services.” Netcraft, March 27, 2024.

GSMA. 2025. “RCS Encryption: A Leap Towards Secure and Interoperable Messaging.” GSMA Newsroom, March 14, 2025.

Larsen, Austin, Matt Lin, Tyler McLellan, and Omar ElAhdan. 2025. “Widespread Data Theft Targets Salesforce Instances via Salesloft Drift.” Google Threat Intelligence Group, August 26, 2025.

Mandiant. 2024. M-Trends 2024: Chinese Espionage Operations Targeting the Visibility Gap. Google Cloud.

Microsoft. 2026a. “Macros from the Internet Are Blocked by Default in Office.” Microsoft Learn.

Microsoft. 2026b. “Manage External Meetings and Chat with People and Organizations Using Microsoft Identities.” Microsoft Learn.

Microsoft Threat Intelligence. 2024a. “Threat Actors Misusing Quick Assist in Social Engineering Attacks Leading to Ransomware.” Microsoft Security Blog, May 15, 2024.

Microsoft Threat Intelligence. 2024b. “Ransomware Operators Exploit ESXi Hypervisor Vulnerability for Mass Encryption.” Microsoft Security Blog, July 29, 2024.

Microsoft Threat Intelligence. 2025. “Think Before You Click(Fix): Analyzing the ClickFix Social Engineering Technique.” Microsoft Security Blog, August 21, 2025.

MITRE. 2025a. “Malicious Copy and Paste, T1204.004.” MITRE ATT&CK.

MITRE. 2025b. “Input Injection, T1674.” MITRE ATT&CK.

MITRE. 2025c. “SVG Smuggling, T1027.017.” MITRE ATT&CK.

NIST. n.d. “Advanced Persistent Threat (APT).” Computer Security Resource Center Glossary. Accessed October 12, 2026.

Richardson, T., and J. Levine. 2011. The Remote Framebuffer Protocol. RFC 6143. IETF.

Van Pelt, Tom. 2026. “RCS Universal Profile 4.1: Stronger Foundations for Secure Messaging.” GSMA Newsroom, July 28, 2026.