Recently, the 360 Advanced Threat Team found that the Transparent Tribe group launched indiscriminate attacks against Windows and Linux systems, with targeted and covert attack methods. In a Windows environment, attackers use.ppam files as carriers to download malicious payloads by embedding macro code, which in turn triggers a complex multi-stage attack chain and ultimately achieves the purpose of stealing secrets; in a Linux environment, attackers use desktop applications to distribute malicious payloads, completing the attack by disguising the file name as the.pdf.desktop suffix to induce the user to execute it.