tokens: This was followed by another great blog by McAfee on the same subject but my focus will be on a specific aspect mentioned in the RSA blog which is the exploit used. FireEye discovered a malicious docx exploiting a zero day vulnerability in Microsoft's Encapsulated Postscript EPS filter, in the summer of 2015.