Security News > 2022 > February > Microsoft Disables Internet Macros in Office Apps by Default to Block Malware Attacks

Microsoft on Monday said it's taking steps to disable Visual Basic for Applications macros by default across its products, including Word, Excel, PowerPoint, Access, and Visio, for documents downloaded from the web in an attempt to eliminate an entire class of attack vector.
"Bad actors send macros in Office files to end users who unknowingly enable them, malicious payloads are delivered, and the impact can be severe including malware, compromised identity, data loss, and remote access," Kellie Eickmeyer said in a post announcing the move.
While the company does warn users about permitting macros in Office files, unsuspecting users - e.g., recipients of phishing emails - can still be lured into enabling the feature, effectively granting the attackers the ability to gain an initial foothold into the system.
As part of the new change, when a user opens an attachment or downloads from the internet an untrusted Office file containing macros, the app displays a security risk banner stating, "Microsoft has blocked macros from running because the source of the file is untrusted."
"If a downloaded file from the internet wants you to allow macros, and you're not certain what those macros do, you should probably just delete that file," Microsoft cautions, outlining the security risk of bad actors using macros.
The updates are expected to be applied to Microsoft 365 users in April 2022, with plans to backport the feature to Office LTSC, Office 2021, Office 2019, Office 2016, and Office 2013 at a "Future date."
News URL
https://thehackernews.com/2022/02/microsoft-disables-internet-macros-in.html
Related news
- CISA tags Microsoft .NET and Apache OFBiz bugs as exploited in attacks (source)
- New Microsoft script updates Windows media with bootkit malware fixes (source)
- Critical RCE bug in Microsoft Outlook now exploited in attacks (source)
- Microsoft says attackers use exposed ASP.NET keys to deploy malware (source)
- Microsoft Identifies 3,000 Leaked ASP.NET Keys Enabling Code Injection Attacks (source)
- Microsoft Uncovers Sandworm Subgroup's Global Cyber Attacks Spanning 15+ Countries (source)
- FINALDRAFT Malware Exploits Microsoft Graph API for Espionage on Windows and Linux (source)
- Microsoft: Hackers steal emails in device code phishing attacks (source)
- Microsoft spots XCSSET macOS malware variant used for crypto theft (source)
- Microsoft Uncovers New XCSSET macOS Malware Variant with Advanced Obfuscation Tactics (source)