A phishing technique to obtain NetNTLM hash from archive extraction in windows.

Seems like Microsoft patched it rather poorly, so it might be still viable.

Was presented at BsidesLjubljana March 2026.