Loading story…
Researchers documented how malicious Microsoft Office documents can use advanced VBA macro techniques to evade static analysis, including bypasses that produce zero detections in tools such as olevba. The reporting highlights how attackers can hide or obfuscate macro logic so that automated inspection fails to surface suspicious behavior, increasing the likelihood that weaponized documents reach users and execute unnoticed.
The activity aligns with MITRE ATT&CK technique T1064, which covers the use of scripting to execute malicious code on victim systems. For defenders, the findings underscore that reliance on static macro inspection alone is insufficient and that Office document analysis should be supplemented with behavioral detection, sandboxing, and controls that restrict or disable untrusted macros.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft moved to block VBA macros by default in Office files downloaded from the internet, targeting a long-running infection path used to deliver malware, phishing payloads, ransomware, and remote access tools. The change applies to Office on Windows for **Access, Excel, PowerPoint, Visio, and Word**, where internet-sourced macro-enabled files now show a **Security Risk** warning tied to **Mark of the Web (MOTW)** metadata instead of prompting users to enable content. After briefly rolling the change back following user feedback, Microsoft resumed rollout with updated guidance for users and administrators, who can still manage exceptions through **Group Policy**, **Trusted Locations**, and **Trusted Publishers**. The decision follows repeated abuse of malicious Office documents in real-world campaigns. Fortinet documented a spam operation using **Black Lives Matter** lures and password-protected Word files to deliver **TrickBot**, while separate analysis showed a macro-enabled Word document using obfuscated VBA and doubly Base64-encoded PowerShell to fetch and run **Remcos RAT**. Researchers also warned that attackers can bypass MOTW-based protections by delivering documents inside container formats such as **ISO** files, where extracted files may lose the `Zone.Identifier` alternate data stream and be treated as local files, allowing macro execution unless additional controls such as **Attack Surface Reduction** rules are enforced.
Aug 15, 2026
The **Emotet** malware operation changed its infection tactics as Microsoft tightened default protections around Office macros, a long-used initial access method for malware delivered through phishing documents. Reporting indicates the group adapted its delivery chain to preserve access to victims despite the reduced effectiveness of malicious macro-enabled attachments. The shift highlights how defensive changes by major software vendors can force established threat actors to retool rather than disappear. For defenders, the development underscores the need to monitor for alternative attachment and execution methods linked to Emotet campaigns, review email security controls, and harden endpoints against follow-on payload delivery after initial compromise.
Aug 14, 2026
Microsoft documented **CVE-2021-40444** as a remote code execution flaw in the MSHTML engine that could be triggered through specially crafted Microsoft Office documents, and security reporting tied the issue to attachment-based phishing campaigns. MITRE ATT&CK maps this activity to **`T1566.001` Spearphishing Attachment**, a technique widely used by both state-backed and criminal actors to gain initial access through Word, Excel, RTF, PDF, archive, and shortcut files sent by email. Security telemetry and malware analysis showed how the technique translated into real-world intrusion activity. A suspicious Word document sample analyzed in ANY.RUN and Trustwave reporting on a trojanized OneNote lure illustrate the broader pattern of weaponized Office attachments being used to execute payloads such as **FormBook**. Splunk also published detection guidance for spotting Office processes loading **`mshtml.dll`**, noting that such module loads can indicate exploitation of **CVE-2021-40444** and may precede arbitrary code execution, data theft, or deeper compromise.
Aug 15, 2026