What Is an Office Macro?
A macro is a small program — historically written in Visual Basic for Applications (VBA) — embedded inside a Word, Excel, or PowerPoint document. Macros were invented in the 1990s for legitimate automation: filling forms, generating reports, looping through spreadsheet rows.
The trouble is that VBA gives the document near-complete access to the host system. A macro can:
- Read and write files anywhere the user can.
- Download arbitrary files from the internet.
- Spawn PowerShell or cmd.exe.
- Modify registry keys.
- Install persistence and pivot to other malware.
Why Macros Were So Popular with Attackers
For attackers, macros were a dream delivery mechanism:
- Email-attachable. Most organisations allow Office documents through email filters.
- Trusted. Users open Word files dozens of times a day without thinking.
- No exploit needed. Unlike exploiting a vulnerability, the macro just needs the user to click "Enable Content".
- High access. Once running, full user privileges.
Major banking trojans and ransomware loaders such as Emotet, TrickBot, IcedID, and Qakbot relied heavily on malicious macros for years.
What Changed in 2022
In 2022, Microsoft began blocking macros by default in Office documents that were downloaded from the internet — marked with the Mark-of-the-Web (MOTW) attribute. Instead of the friendly "Enable Content" yellow bar, users see a red bar explaining that macros are blocked for security.
This change measurably reduced macro-based attacks within months — but attackers adapted.
How Attackers Adapted
1. ISO and IMG Disk Images
ISO files do not carry the Mark-of-the-Web through extraction. So attackers email an ISO containing a document; the user mounts the ISO, opens the document, and macros are enabled by default.
2. HTML Smuggling
A malicious HTML attachment reconstructs a payload inside the browser using JavaScript — bypassing email gateway scanning of the underlying file.
3. OneNote Files
OneNote (.one) files can contain embedded executables disguised as document elements. They were heavily abused in 2023.
4. Shortcuts and Scripts
LNK files, VBS, JS, and HTA scripts attached directly to email — sometimes hidden inside password-protected ZIPs.
5. The Old Method, Still
Many attackers still use macros — they just target organisations that have explicitly un-blocked them, or use lures convincing enough that users click "More info → Run anyway".
How to Stay Safe
For Individuals
- Leave macro blocking on. Do not unblock unless you wrote the document yourself.
- Never click "Enable Content" on an unexpected document — even if it appears to be from your manager.
- Open documents from untrusted sources in Protected View only.
- Scan documents with Virus Purge before opening if you have any doubt.
For IT Administrators
- Block macros via Group Policy across the organisation.
- Block ISO, IMG, VHD, OneNote attachments at the email gateway.
- Enable Attack Surface Reduction rules in Microsoft Defender.
- Train users specifically on the new attack patterns — most security awareness training is years out of date.
The Lesson
Macro malware is the textbook example of a security trade-off that took thirty years to fix. Even now, the underlying capability — running code from a document — has not gone away; it has just become friction-laden. That friction is mostly what stops casual attacks. Do not casually remove it.