DocSwap

How DocSwap Works

DocSwap is a malware delivery pattern that abuses trust in ordinary document exchange. The attacker relies on a file that looks like a normal attachment, shared document, or paperwork workflow, then uses that trust to move a user toward executing code or opening a hostile path.

This matters because document-handling paths are often treated as low risk by users and by some security controls. When a file is expected to be a report, form, invoice, or scan, the deception can bypass attention long enough for the payload or redirect to take effect.

Why Document Deception Is Effective

DocSwap succeeds because the filename, icon, extension, and delivery channel can all be made to resemble legitimate business material. The real danger is not the document itself, but the mismatch between what the file appears to be and what it actually does when opened or processed.

In practice, this technique often exploits user expectations around attachments, downloads, and shared files. A document can be used as a wrapper for script launch, a staged payload, or a redirect to another malicious resource, so the initial file often serves as an entry point rather than the final weapon.

For defenders, the key question is whether the workflow allows a document to trigger something outside the normal content handling path. MITRE ATT&CK Enterprise Matrix is useful here because it helps map document-delivered intrusion steps to adversary behaviour, including execution and follow-on activity.

What To Check In An Environment

Exposure is usually highest where file exchange is frequent, external documents are accepted, and users can open content from mail, chat, shared drives, or download folders without inspection. The practical check is whether the environment can identify file origin, file type, and any attempt to execute from locations that should remain non-executable.

File-type mismatches, unusual extensions, nested archives, and documents that require macros or embedded launchers deserve close review. So do cases where a file arrives through a trusted channel but behaves in a way that does not match the expected document class.

NIST SP 800-53 Rev 5 Security and Privacy Controls aligns well with this problem because control families such as access control, system integrity, audit, and configuration management all support reducing document-borne execution risk.

Prevention, Detection, And Response

Defence should focus on reducing the chance that a document can become an execution path. That means limiting execution from user-writable locations, watching for suspicious child processes launched from office or viewer applications, and treating document origin and file metadata as part of the security decision.

Detection should not stop at the inbox or download alert. Teams should also look for post-open behaviours, such as unexpected process creation, abnormal script invocation, or a user file being renamed or swapped after delivery. The defensive goal is to catch the handoff from document to code, not just the initial receipt.

Where a document has already been opened, review for persistence, secondary payload retrieval, and misuse of any credentials or sessions available on the host. A malicious document often aims to create a broader foothold after the first user interaction.

Risk and Threat Considerations

DocSwap is risky because it weaponises a normal business behaviour, which lowers suspicion and can let a malicious file reach an execution point before defenders notice. The consequence can range from a single endpoint compromise to wider access if the payload steals data, launches more malware, or uses the victim system to reach other internal resources.

Failure mechanism: The technique depends on users and controls trusting the apparent document while missing the mismatch between the visible file and the action it triggers. That gap can allow execution, redirection, or payload staging before content filters or users recognise the deception.

Impact: Successful abuse can lead to malware infection, follow-on credential theft, lateral movement, or data exposure, especially when document workflows are common and execution restrictions are weak.

Practitioner Guidance

Why practitioners should care: DocSwap is not just a phishing style, it is an execution path disguised as routine file handling. Treat document provenance, file type validation, and execution control as part of the same control surface, not as separate problems.

What to watch for: Pay attention to documents that arrive through trusted channels but behave like launchers, droppers, or redirects. Unusual file extensions, mismatched MIME or content signatures, and execution from writable user paths are strong warning signs.

Practitioner takeaway: The most useful defensive mindset is to assume the document may be a wrapper, then verify whether it can actually cause code execution or a redirect before it is trusted.