How to Detect Malicious Macros in Office Files?

Macro malware has been a known problem for years. In fact, it is so widespread that Microsoft tries to address it with every update to its Office suite. However, the situation prevails. What can you do to protect yourself?

Macros are powerful tools used by Microsoft Office applications and designed to automate tedious, repetitive tasks. But while they are handy, they can be dangerous in the wrong hands.

While you should always scan downloads for viruses, detecting macro malware is more complicated because malicious code is hidden inside MS Office files and requires activation. However, it is not a losing battle – you can still protect yourself from macro viruses and malware.

Where does Macro Malware Hide?

Hackers use macros to infect systems with various types of malware – those that “just” display unwanted windows and those capable of corrupting other files or formatting hard drives. No operating system is safe – Windows, macOS, or Linux distributions are equally susceptible to infection as long as they can open MS Office files.

More often than not, the infected files pretend to be safe and professional. Usually, they pose as receipts, invoices, and other financial or business-related documents. It is easy to fall into the trap, especially if you run a business or even a small freelance practice and regularly receive such files from clients and partners.

Microsoft knows about the issue. You have surely noticed that programs such as Excel, Word, and PowerPoint prompt you to enable macros when you open a downloaded file. It’s because macros are disabled by default in all current MS Office applications.

However, some users click Yes to each prompt without thinking, resulting in macros being turned on even if they’re unnecessary.

Hackers know that macros must be enabled for their malware to work, so they even include instructions for their victims. Users unfortunately fall for the trick, believing the files are legitimate and require macros to function correctly.

What are the Most Common Symptoms of Macro Malware?

Macro viruses and malware are not very different from other types of malicious software. Typically, the macro is only the first step of the infection. It is designed to kick-start a chain reaction of downloading other, more advanced malicious files.

If your computer is infected, it may exhibit symptoms such as:

• slowing down and/or frequent crashes
• overheating
• displaying strange errors and windows
• corrupting files, making documents unreadable
• displaying new icons that you do not recognize

How Not to Fall Victim to Macro Malware?

1. Do not download and open files from untrusted sources(!)

This is the most critical advice.

Most macro malware spreads via phishing emails. They pretend to be something they are not, such as messages from co-workers, banks, etc. These emails look legitimate but contain dangerous files, such as Excel or Word documents with malicious macros.

You should only download email attachments if you are sure that the sender is who they say they are. If unsure, contact the sender through another channel and ask if they sent you the files.

2. Do not enable macros if they are not needed

Even if Excel or Word prompts you to enable macros, consider whether it’s necessary. If the file only contains simple data, you don’t need macros to access it. You should only allow macros if:

1. You know the sender of the file.
2. Macros are needed for the file to function properly (and you know that they are, not just been told so by the sender of an email).

Also Read: Microsoft Has Blocked Macros from Running Excel

3. Use an antivirus (and update it)

Antiviruses can detect most known types of malware, including ones deriving from malicious macros. You should never leave your device unprotected. Always let an antivirus software run in the background and ensure it is up-to-date.

4. Use a trusted email service

Most email providers filter out spam. It doesn’t mean that you will not get any spam ever, of course. Still, the spam-filtering feature drastically lowers the number of unwanted and potentially dangerous messages in your inbox. It means fewer phishing attempts and suspicious attachments.