Abuse of trusted services

Attacker use of widely permitted platforms such as document suites, edge compute services and public blockchains to host attack code or command traffic, so the requests blend into normal allowed activity.