Microsoft blocks Office VBA macros by default

A default change to improve security

Microsoft is finally planning to block Visual Basic for Applications (VBA) macros by default in several Office apps. The change applies to Office files downloaded from the Internet that contain macros, so Office users can no longer enable certain content with the simple click of a button.

“The default setting is more secure and is expected to keep more users safe, including home users and information workers in managed organizations,” explains Kellie Eickmeyer , a chief executive officer at Microsoft.

Hackers have been targeting Office documents with malicious macros for years, and while Office has long asked users to click to disable macros, this simple button can lead to “serious malware, compromised identity, data loss, and remote access.” Instead of a button, a security risk banner appears with a link to a Microsoft support article, but not an easy way to enable macros.

Microsoft plans to preview the change with its Current Channel (Preview) users in early April, before rolling it out to its regular Microsoft 365 customers. The change to block VBA macros from the web affects Access, Excel, PowerPoint, Visio, and Word on Windows. Microsoft also plans to update Office LTSC, Office 2021, Office 2019, Office 2016 and even Office 2013 to block internet VBA macros.

This is a major change that could affect many legitimate usage scenarios for VBA macros, and means that Office users can only enable the macros by specifically checking an unblock option on a file’s properties. That’s a lot more steps than usual, and ones that Microsoft hopes will help prevent security vulnerabilities in the future.

“Macros account for about 25 percent of all ransomware arrivals,” explains security researcher and former Microsoft employee Kevin Beaumont . “Keep de-risking macros and macro functions. It’s really important. Thanks to all the people behind the scenes who are doing this.” Marcus Hutchins, a security researcher best known for stopping the global WannaCry malware attack, also celebrated Microsoft’s changes , but noted that the company “decided to do the bare minimum” after years of malware infections. .

Source: theverge