tokens: The malware is delivered via an innovative and unique technique: a downloader we are calling Carp uses malicious macros in Microsoft Excel documents to compile embedded C# C Sharp Programming Language source code into an executable that in turn is run to deploy the Cardinal RAT malware family.