Microsoft that is known for products like SharePoint said on Monday that it has been undertaking efforts to deactivate Visual Basic for Apps (VBA) macros by default in its Office 365 products, such as Word, Excel, PowerPoint, Access, and Visio, for documents obtained over the internet, in an effort to eradicate a whole type of attack vector.
“Malicious people transmit macros in Office 365 files to end-users who mistakenly allow them, harmful payloads are transmitted, and the consequences may be serious, involving malware, stolen identification, loss of data, and remote access,” Kellie Eickmeyer explained in a blog article disclosing the change.
Whereas the corporation warns users against allowing macros in Office 365 files, naïve users — for example, victims of phishing emails — might still be persuaded to enable the capability, essentially offering the hackers an early presence in the system.
As part of the upcoming adjustment, whenever a user accesses an attachment or installs an untrustworthy Microsoft 365 file containing macros from the web, the application shows a security risk alert that states, “Microsoft has prohibited macros from executing because the origin of the file is untrustworthy.”
“If a downloaded file from the web asks you to accept macros and you’re not sure what those macros perform, you should generally just remove that file,” Microsoft warns, explaining the safety danger posed by criminal individuals who use macros.
Users may unblock macros for any downloaded file by right-clicking it, choosing Properties from the context menu, and checking the “Unblock” button on the General tab. The improvements are scheduled to go live in April this year for Microsoft 365 subscribers, including intentions to backport the functionality to Office LTSC, Office 2021, Office 2019, Office 2016, and Office 2013 at a “date in the future.”
The change comes less than a month after Microsoft deactivated Excel 4.0 (XLM) macros, another extensively exploited tool for malware distribution, by default to shield from safety concerns.
