Long story short, got duped into opening an XLSM in Excel, with macros being enabled. Realised instantly.
Digged into the Excel structure, found the following (extremely obfuscated) payload:
I was reading a recent report about an APT and jumped into this Technique:
This technique is called:
Exploitation for Client Execution
And that might match ...