Macro Malware Makes a Comeback

Remember the “old” days... way back in the 1990s when the big threat to your computer was a virus that was unleashed when you triggered a macro? Back then, the advice from security experts was to disable macros in your software. Microsoft eventually helped by disabling them by default in its Office suite of programs and ultimately anti-malware programs won the macro-virus battle. However, according to a recent report by Microsoft’s Malware Protection Center, macro malware is making a comeback and affects over 500,000 unique machines. 

Like the past, today’s macro viruses are still executed when an email attachment is opened, but are different in that they are packaged in zipped files to hide from antivirus scanning software. They are also incognito in links and on a more technical level, they use Microsoft’s PowerShell capabilities. A variant of the online banking malware Dridex has been making the rounds via this method. Dridex is based on the online banking credentials stealing malware called Cridex, which is a version of the infamous Gameover Zeus. In one recent case, Intel Security found Dridex hidden in the previously “safe” Microsoft Word file type or .xml type.

Social engineering is put to use in these scenarios as well. Hackers will now try to convince potential victims to enable their macros again to let the malware loose.

Social engineering is a broad term that used to describe the trickery that hackers employ to convince people to engage in behavior outside their normal security procedures. Phishing is a type of social engineering.  According to Kaspersky Lab, over 50 million phishing attempts occurred in just the first quarter of 2015.

This is why learning how to identify phishing attempts remains important. There are usually some easy-to-spot ways to determine if an email message is phishing for something:

• There are incorrect uses of the language, typos, and grammatical errors.
• Links or attachments are often included in the message with a sense of urgency or significant importance to scare the recipient so that he or she will open the attachment or click the link without much thought.
• If the mouse pointer hovers over the link, it looks like it is going to a nonsense address.
• Graphics may differ ever-so-slightly from the authentic versions found on the legitimate sites.

Therefore, review unexpected email messages carefully and don’t fall for any of these. It’s best to resist urges to click on the attachments or links. Make sure anti-malware software is installed and kept updated. Double check to ensure that software is configured to scan attachments upon arrival in the in-box and never open those or click a link from untrusted sources. Also make sure it’s expected before taking action.

It is also still recommended to disable macros by default in any software program. Sometimes the tried and true is still appropriate.