May 12, 2015 By Shane Schick 2 min read

Opening spam email messages or the suspicious attachments they often contain are huge risks, but the real danger may be in enabling malicious macros hidden in documents, a security researcher recently warned.

According to Bart Blaze, who published the findings on his own Blaze’s Security Blog, the kind of spam used by cybercriminals to steal data or take over computers is becoming more complex and deadlier than ever. Hackers might send a phony bill, for example, which includes a document written in Microsoft Word. Although potentially malicious macros are usually disabled by default, those who allow them after being prompted to do so might suddenly find themselves presented with a distraction while malware infects their machine.

This kind of attack can be nearly invisible to the average user since the attackers in question are using formats that save Web page content along with animations, applets and so on, SecurityWeek.Com reported. That means what seems like an innocent document could be packed with a Trojan downloader and other components that malicious macros set free. The malware that raises the most concern is, in all likelihood, those that target financial institutions and their customers. SecurityWeek.Com suggested that in this case, the payload may have been the banking Trojan Dyre.

Microsoft is well aware that malicious macros are making a comeback of sorts among cybercriminals. In a recently released report from its Malware Protection Center, the company said it has seen more than half a million such attacks, primarily within North America and the U.K. Although the social engineering aspects of these hacker attempts cannot be ignored — the bad guys have gotten pretty good at putting what look like important documents in spam messages — there are other tricks being added to the mix.

BankInfoSecurity suggested more cybercriminals are using the PowerShell scripting language to create the macros, and they are then putting them in compressed zip files that aren’t as easily detected by common security software. Even if there are fewer hackers using these techniques than there would have been in the ’90s, they might be much more focused and effective in carrying them out today.

It’s also important to note that Microsoft documents aren’t the only vehicle for malicious macros. V3.co.uk reported there has been a spam campaign spreading the harmful Bartalex malware using macros within Dropbox. Fair warning: If it’s not immediately easy to open or use certain files, there may be a good reason to leave them alone.

More from

FYSA – Adobe Cold Fusion Path Traversal Vulnerability

2 min read - Summary Adobe has released a security bulletin (APSB24-107) addressing an arbitrary file system read vulnerability in ColdFusion, a web application server. The vulnerability, identified as CVE-2024-53961, can be exploited to read arbitrary files on the system, potentially leading to unauthorized access and data exposure. Threat Topography Threat Type: Arbitrary File System Read Industries Impacted: Technology, Software, and Web Development Geolocation: Global Environment Impact: Web servers running ColdFusion 2021 and 2023 are vulnerable Overview X-Force Incident Command is monitoring the disclosure…

What does resilience in the cyber world look like in 2025 and beyond?

6 min read -  Back in 2021, we ran a series called “A Journey in Organizational Resilience.” These issues of this series remain applicable today and, in many cases, are more important than ever, given the rapid changes of the last few years. But the term "resilience" can be difficult to define, and when we define it, we may limit its scope, missing the big picture.In the age of generative artificial intelligence (gen AI), the prevalence of breach data from infostealers and the near-constant…

Airplane cybersecurity: Past, present, future

4 min read - With most aviation processes now digitized, airlines and the aviation industry as a whole must prioritize cybersecurity. If a cyber criminal launches an attack that affects a system involved in aviation — either an airline’s system or a third-party vendor — the entire process, from safety to passenger comfort, may be impacted.To improve security in the aviation industry, the FAA recently proposed new rules to tighten cybersecurity on airplanes. These rules would “protect the equipment, systems and networks of transport…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today