Macro Intruders: Sneaking Past Office Defenses
Summary: Cisco Talos describes how Microsoft Word's OOXML validation in WWLIB.DLL only checks MIME type when the file extension suggests an OOXML file, so a DOCM file containing macros renamed with a non-OOXML extension such as RTF will open in Word and run its embedded macro code. Talos found that four distinct DOTM files accounted for 64% of all DOTMs collected over a four-month period, and that 5% of all collected macros accounted for those 64% of DOTM files, with 254 distinct collisions studied after excluding one empty sample.
What you should know: A single renamed file defeats the extension-based check Windows and Word rely on, and the concentration Talos measured - 5% of macros behind 64% of malicious DOTM files - means a small set of samples covers most of what defenders would face.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026