The Trojan activates when a potential victim hovers their computer mouse over a text link or image within the fake PowerPoint slide that is usually delivered via spam email.