Back 
Microsoft Word, Excel, PowerPoint, and other Office document formats are popular among attackers, who abuse them to infect their victims with ransomware, infostealers, backdoors, and other malware.
- The attacker sends a link to download an Office document to the victim via email, social media, SMS, cloud storage apps, or messaging apps.
- The attacker uses social engineering to convince the victim to download the file, open it using Microsoft Office, and enable content.
- If the victim enables content, the malicious code in the Office document infects their computer.
In this article, we look at the anatomy of a recent Office document attack from the victim’s perspective, highlight the most common types of Office document attacks seen today, and suggest strategies to reduce your risk of becoming the latest victim.
Anatomy of an Office document attack
In early 2022, Netskope saw a series of Office document attacks using malicious PowerPoint files to deliver the remote access Trojans AveMaria/Warzone and AgentTesla. The victims received an email with a generic message asking them to review an order. Fake invoices, order forms, inventory lists, shipping notifications, and sales quotes are commonly used by attackers to bait victims into downloading malicious Office documents. When the victim downloads and opens the attachment using Microsoft PowerPoint, they are presented with a dialog box that asks them whether they want to enable macros.
This is a pivotal moment for the victim. If they click “Disable Macros,” nothing will happen. They will see a blank page. Perhaps this nothingness will inspire them to try again and click “Enable Macros” instead? If they click “Enable Macros,” the malicious code embedded in the document will run automatically and their computer will be infected with a remote access Trojan within seconds, which means the attacker will now be able to access the victim’s computer.
Another similar attack uses Excel instead of PowerPoint, but with an identical flow. Below is another example from January of an Emotet Office document attack. The attacker uses the body of the document itself to do some social engineering, telling the user they must open the document on their computer and must click “Enable Content.” If they don’t, they won’t be able to open the document. Both of these are required steps for the attacker to infect the victim’s computer, which is why the attacker is so insistent.