Cybercrime, three well known techniques still successfully used to avoid detection
Yoroi-Cybaze cyber security experts: They are “The Broken Doc”, “Hide Payload with Office Developer Mode”, and “Spoofed Signature”or “Certificate Spoofing”.
Cybercrime for phishing uses web fonts to implement the encoding
Proofpoint cyber security experts: Threat actors exploit fake fonts to decode content and evade detection. At least since May 2018, but maybe earlier.