How do macro viruses work and why are they dangerous for office documents?

Macro viruses are written in built-in programming languages, such as Visual Basic for Applications, which are supported by office applications. They embed themselves inside text documents, spreadsheets, or presentations and are activated automatically or at the user's discretion when the infected file is opened.

The danger of macro viruses lies in their ability to bypass traditional firewalls, as they disguise themselves as legitimate working documents. Upon opening a file, the malicious code can trigger the downloading of additional payloads from the network, change system settings, or encrypt important local files.

To protect against such threats, modern office suites block the execution of macros by default for files from untrusted sources. Users and administrators are advised to completely disable the automatic execution of macros at the group policy level and never enable them upon the request of suspicious documents received from the internet.