CyberGlossary

Malware

Macro Virus

Also known as: Office macro malware, VBA virus

Definition

A virus written in the macro language of an office application that runs when an infected document is opened and macros are enabled.

Macro viruses are written in scripting languages such as Visual Basic for Applications (VBA) and embedded in Office documents (Word, Excel, PowerPoint), email attachments, or templates. When a user opens the document and enables macros, the code executes with the privileges of the user and can drop additional malware, exfiltrate data, or pivot to other systems. Although Microsoft has tightened defaults — disabling macros from the internet and warning on documents marked with Mark of the Web — macro-based phishing remains common in initial-access campaigns. Defences include blocking macros from external sources, signed macro policies, attack surface reduction rules, and user training on suspicious attachments.

Examples

  • The 1999 Melissa virus spreading via infected Word documents.
  • Modern phishing campaigns delivering Emotet or Qakbot through malicious Excel macros.

Related terms