What are macro-enabled document attacks?

Macro attacks embed malicious code in Office documents. When victims enable macros (often prompted by social engineering), the code executes, downloading and installing malware or performing malicious actions directly.

Attack flow: email delivers document claiming to require macro enablement ("Enable editing to view content"), victim enables macros, embedded code runs, malware installs or data exfiltrates.

Microsoft has restricted macros significantly, blocking internet-sourced macros by default. Attackers adapt: using other file types, exploiting trusted locations, or social engineering users to manually unblock. Corporate policies should block macros from external sources.