Malicious Macros

Execute Visual Basic for Applications (VBA) code embedded in a macro-enabled Microsoft Office document. This record covers macro execution itself; document delivery and any later payload download, child-process launch, or command-and-control behavior are separate behaviors. Whether VBA runs depends on Office trust and organization policy. Microsoft 365 Apps blocks macros in files from the internet by default under the applicable policy, so opening a document does not establish that its VBA ran.