Macro malware is malicious code written in a document macro language, most often Visual Basic for Applications (VBA) in Microsoft Office files, that runs when the victim opens the document and enables macros.
How macro malware works
Office applications support macros to automate tasks. Attackers abuse this feature by embedding VBA code in Word documents, Excel spreadsheets or other files and sending them as invoices, CVs or delivery notices in phishing emails. The document usually shows a fake message asking the user to “enable content”. Once enabled, the macro typically launches PowerShell or VBScript, downloads a malware loader and runs it. Excel 4.0 (XLM) macros and embedded OLE objects were used in the same way. MITRE ATT&CK covers the user step as User Execution: Malicious File (T1204.002).
Why macro malware matters
Concept (1995) was the first widespread Word macro virus, and Melissa (1999) spread worldwide by mailing itself to contacts in Outlook. In the 2010s macro documents became the main delivery method for Emotet, Dridex, TrickBot and many ransomware campaigns. The landscape changed in 2022, when Microsoft began blocking VBA macros by default in files downloaded from the internet (marked with the Mark of the Web). Attackers then shifted to ISO and ZIP archives, LNK shortcuts, OneNote files and HTML smuggling, but macro-based attacks have not disappeared, especially where the default is overridden.
How to protect against macro malware
- Keep Office’s default blocking of internet macros and use Group Policy to disable macros for users who do not need them.
- Allow only digitally signed macros from trusted publishers.
- Enable Attack Surface Reduction rules that stop Office apps from creating child processes.
- Train users never to click “Enable content” in unexpected documents.
