Beware of the Macros on Macros E-Mail Scam

It’s a real pain jumping through hoops to try and stay a step ahead of online miscreants, but it’s a fact of life that we need to accept these days.   Our company does a lot to keep these s***weasels at bay.  Getting that six-digit authentication code from your phone, and typing it in is a real pain, especially if you forgot your phone that day.  But, there’s a good reason for doing it.

But these pestiferous villains come up with new ways every day to trick you into falling prey to their nefarious and diabolical plans.  The latest warning from our Townsquare Media team is about “Macros on macros.”

Cybercriminals are always finding new ways to bypass your security filters. In this scam, the bad guys start by sending a Microsoft Word document that has no malicious code or links within it. Once opened in Microsoft Word, the innocent-looking document includes a pop-up that asks you to enable macros. A macro, short for macroinstruction, is a set of commands that can be used to control Microsoft Word, Microsoft Excel, and other programs.

Here’s how the attack works: If you open the attached Microsoft Word document and enable macros, the document automatically downloads and opens an encrypted Microsoft Excel file. The Microsoft Excel file instructs Microsoft Word to write new commands into the same Microsoft Excel file. Once the new commands are added, the Microsoft Excel file automatically downloads and runs a dangerous piece of malware onto your device.

Use the tips below to avoid falling victim to an attack like this one:

• Never click a link or download an attachment from an email that you were not expecting.
• Before enabling macros for a file, contact the sender using an alternative line of communication, such as making a phone call or sending a text message. Verify who created the file, what the file contains, and why enabling macros is necessary.
• This type of attack isn’t exclusive to Microsoft products. The technique could easily be used on several other programs. Always think before you click.