What Are Office Document Macros and Why They Pose a Risk

"Enable Content" is the most dangerous button in Microsoft Office. Behind that innocent prompt can hide a malicious macro that runs with your user permissions and can fully compromise your computer.

What is a macro?

A macro is a program embedded inside an Office document (Word, Excel, PowerPoint). They were originally designed to automate repetitive tasks: formatting tables, generating reports, processing data. They're written in VBA (Visual Basic for Applications), a programming language with access to the file system, network, and other operating system resources.

The same power that makes them useful makes them an attack vector: a malicious macro can do everything an installed program on your computer could do.

What can a malicious macro do?

• Download and execute malware from the internet
• Steal information from the system (files, credentials, session tokens)
• Install ransomware that encrypts your documents
• Spread by sending emails from your account to your contacts
• Establish persistence by creating scheduled tasks or modifying the registry

Formats that can contain macros

Not all Office files are the same. Some formats support macros and others don't:

Format	Extension	Supports macros?
Word document	.docx	Not by default (but possible)
Word macro-enabled	.docm	Yes
Excel workbook	.xlsx	Not by default (but possible)
Excel macro-enabled	.xlsm	Yes
Excel binary	.xlsb	Yes
PowerPoint	.pptx	Not by default (but possible)
PowerPoint macro-enabled	.pptm	Yes
Legacy formats	.doc, .xls, .ppt	Yes
OpenDocument	.odt, .ods, .odp	Possible (Basic/Scripts)

An important detail: OOXML formats (.docx, .xlsx, .pptx) are ZIP files containing XML. Although they're not designed for macros, they can technically contain a vbaProject.bin component that includes them.

How are malicious macros distributed?

The typical scenario:

1. You receive an email with an Office attachment (usually an "invoice," "purchase order," or "urgent document")
2. When you open the document, Office shows a yellow bar: "Macros have been disabled"
3. The document includes instructions (sometimes elaborate) to convince you to click "Enable Content"
4. Once you do, the macro executes and the damage is done

Attackers are creative with social engineering: documents that appear to be protected, instructions that mimic Office interfaces, or urgency messages to make you act without thinking.

How to protect yourself

1. Never enable macros in documents received by email, unless you're absolutely sure of the source and the need.
2. Prefer macro-free formats: if someone sends you a .docm when a .docx would suffice, that's a red flag.
3. Check the extension: formats ending in "m" (.docm, .xlsm, .pptm) are explicitly designed to contain macros.
4. Use protected view: Office opens email attachments in protected mode by default. Don't disable this feature.

How BrisaMail handles it

BrisaMail implements macro inspection at multiple levels:

• Explicitly macro-enabled formats (.docm, .xlsm, .pptm, .xlsb): automatically flagged with a warning because these formats confirm the presence of macros.
• OOXML formats (.docx, .xlsx, .pptx): BrisaMail opens the file as a ZIP and actively searches for the vbaProject.bin component and VBA declarations in the [Content_Types].xml manifest. If it finds macros where there shouldn't be any, the alert is more severe.
• OpenDocument formats (.odt, .ods, .odp): inspects for the presence of Basic/ and Scripts/ directories within the file.
• Legacy formats (.doc, .xls, .ppt): being OLE2 binary files, they can't be safely inspected. BrisaMail informs you that the format may contain macros and recommends caution.

All this analysis happens automatically when viewing the message, without needing to download or open the file.

Conclusion

Macros remain one of the most widely used attack vectors due to their effectiveness. The key is to distrust any document that asks you to "enable content" and use tools that inform you of the risk before you make a decision.