Microsoft will block VBA macros on all Office apps

(Image Courtesy: Reuters)

Visual Basic for Applications (VBA) macros are powerful automation tools for Microsoft Office, that are designed to make routine entry work simpler.

The problem is that these have long been abused by hackers and bad actors to deliver malicious payloads such as ransomware to unsuspecting users.

Microsoft has announced that it will now start blocking macros by default, prompting the user with a new banner that will explain them the risks of running macros from an untrusted source. The company has also added a Learn More button that links to an article explaining the security risks.

(Image Courtesy: Microsoft)

"A wide range of threat actors continue to target our customers by sending documents and luring them into enabling malicious macro code," said Tom Gallagher from the Office Security team.

"Usually, the malicious code is part of a document that originates from the internet (email attachment, link, internet download, etc.). Once enabled, the malicious code gains access to the identity, documents, and network of the person who enabled it."

The company said that any macros that are obtained from the internet, will be blocked by default. Microsoft said that this will be more secure and "expected to keep users safe including home users and information workers in managed organisations."

For now, the functionality will be limited to the Windows version of Microsoft Office and will be enabled in Access, Excel, PowerPoint, Visio and Word.

Microsoft will roll out the new change in a preview (ver. 2203) due out in the Current Channel in early April. These will then gradually roll out to the Monthly Enterprise Channel and Semi-Annual Enterprise Channel.