Malicious actors are always on the lookout for vulnerabilities that they can exploit before a patch is developed. While the vulnerability is open, attackers will write and implement a code to take advantage of it. This is known as exploit code. The exploit code can lead to the software users being victimised – through identity theft or other cybercrimes.

Once attackers identify a vulnerability, they need a way of reaching the vulnerable system. This can be through a socially engineered email – an email that is masked to look like it’s from a known or legitimate contact but is actually from the attacker. Through the message, the attacker will try to convince the user to perform an action that will allow their code to run, such as opening a file or visiting a malicious website. If the user does so, the attacker’s malware will infiltrates the user’s files and steal confidential data.