mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-14 18:03:37 +00:00
53 lines
2.5 KiB
Markdown
53 lines
2.5 KiB
Markdown
---
|
||
title: Macro malware
|
||
description: Learn about how macro malware works, how it can infect devices, and what you can do to protect yourself.
|
||
keywords: security, malware
|
||
ms.prod: w10
|
||
ms.mktglfcycl: secure
|
||
ms.sitesec: library
|
||
ms.localizationpriority: medium
|
||
ms.author: dansimp
|
||
author: dansimp
|
||
ms.date: 07/01/2018
|
||
---
|
||
# Macro malware
|
||
|
||
Macros are a powerful way to automate common tasks in Microsoft Office and can make people more productive. However, Macro malware uses this functionality to infect your device.
|
||
|
||
## How Macro malware works
|
||
|
||
Macro malware hides in Microsoft Word or Microsoft Excel documents and are delivered as email attachments or inside ZIP files. These files use names that are intended to entice or scare you into opening them. They often look like invoices, receipts, legal documents, and more. Examples of filenames include:
|
||
|
||
- case number.doc
|
||
- e-ticket_79010838.doc
|
||
- fax_msg896-599-5459.doc
|
||
- invoice_723961.doc
|
||
- legal_complaint.doc
|
||
- logmein_coupon.doc
|
||
- receipt_3458934.doc
|
||
|
||
Macro malware was fairly common several years ago because macros ran automatically whenever you opened a document.
|
||
|
||
However, in recent versions of Microsoft Office, macros are disabled by default. This means malware authors need to convince you to turn on macros so that their malware can run. They do this by showing you fake warnings when you open a malicious document.
|
||
|
||
If you are fooled into enabling macros in a document that contains malware, you could be infected. We've have seen macro malware download threats from the following families:
|
||
|
||
- Ransom:MSIL/Swappa
|
||
- Ransom:Win32/Teerac
|
||
- TrojanDownloader:Win32/Chanitor
|
||
- TrojanSpy:Win32/Ursnif
|
||
- Win32/Fynloski
|
||
- [Worm:Win32/Gamarue](https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=Win32/Gamarue)
|
||
|
||
## How to protect against macro malware
|
||
|
||
These kinds of threats require users to enable macros.
|
||
|
||
Protect yourself and your organization by keeping an eye out for suspicious attachments and check your macro settings.
|
||
|
||
- Check if macros are disabled in your Microsoft Office applications. In enterprises, IT admins set the default setting for macros:
|
||
- [Enable or disable macros](https://support.office.com/article/Enable-or-disable-macros-in-Office-documents-7b4fdd2e-174f-47e2-9611-9efe4f860b12) in Office documents
|
||
|
||
- Don’t open suspicious emails or suspicious attachments
|
||
|
||
- If you get an email from someone you don’t know, or an invoice for something you don’t remember buying, delete it. Spam emails are the main way macro malware spreads. |