windows-itpro-docs/windows/security/threat-protection/intelligence/macro-malware.md

title, ms.reviewer, description, keywords, ms.prod, ms.mktglfcycl, ms.sitesec, ms.localizationpriority, ms.author, author, manager, audience, ms.collection, ms.topic, search.appverid

title	ms.reviewer	description	keywords	ms.prod	ms.mktglfcycl	ms.sitesec	ms.localizationpriority	ms.author	author	manager	audience	ms.collection	ms.topic	search.appverid
Macro malware		Learn about macro viruses and malware, which are embedded in documents and are used to drop malicious payloads and distribute other threats.	security, malware, macro, protection, WDSI, MMPC, Microsoft Malware Protection Center, macro virus, macro malware, documents, viruses in Office, viruses in Word	w10	secure	library	medium	ellevin	levinec	dansimp	ITPro	M365-security-compliance	article	met150

Macro malware

Macros are a powerful way to automate common tasks in Microsoft Office and can make people more productive. However, macro malware uses this functionality to infect your device.

How macro malware works

Macro malware hides in Microsoft Office files and are delivered as email attachments or inside ZIP files. These files use names that are intended to entice or scare people into opening them. They often look like invoices, receipts, legal documents, and more.

Macro malware was fairly common several years ago because macros ran automatically whenever a document was opened. However, in recent versions of Microsoft Office, macros are disabled by default. This means malware authors need to convince users to turn on macros so that their malware can run. They do this by showing fake warnings when a malicious document is opened.

We've seen macro malware download threats from the following families:

• Ransom:MSIL/Swappa
• Ransom:Win32/Teerac
• TrojanDownloader:Win32/Chanitor
• TrojanSpy:Win32/Ursnif
• Win32/Fynloski
• Worm:Win32/Gamarue

How to protect against macro malware

• Make sure macros are disabled in your Microsoft Office applications. In enterprises, IT admins set the default setting for macros:

  • Enable or disable macros in Office documents

• Don’t open suspicious emails or suspicious attachments.

• Delete any emails from unknown people or with suspicious content. Spam emails are the main way macro malware spreads.

• Enterprises can prevent macro malware from running executable content using ASR rules

For more tips on protecting yourself from suspicious emails, see phishing.

For more general tips, see prevent malware infection.