VBA (Visual Basic for Applications) macros haven’t been a significant malware threat for a few years now. Ever since Microsoft disabled VBA macro execution by default in the Microsoft Office suite, malicious VBA macros can’t execute without user intervention.
From the point of view of malware developers, though, this is not a defeat. It’s just a challenge to overcome. Rather than abandoning VBA macro malware completely, malware developers simply came up with a new approach to lure users into enabling VBA macro execution, and opening their PCs up to attack.
A white paper by a Sophos Labs researcher describes the new VBA macro threat in detail, and summarizes why it is that attackers don’t need to bother with sophisticated exploit code. The user is the weakest link, and it’s much easier to execute an attack through social engineering rather than trying to outsmart the operating system or applications.
Take a look at this post from my Minimal Risk blog on CSOOnline.com: VBA macros are a serious malware threat once again