The company has also not explained the reason for this decision and has yet to let customers know publicly that it does VBA macros embedded in Office documents malicious programs are no longer automatically blocked in Access Excel Power Point vision And Word
The company notified administrators on Thursday in the Microsoft 365 Message Center (under MC393185 or MC322553) with the following words:
Based on your feedback, we’re canceling this change to the current channel, appreciate the feedback we’ve received so far, and are working on improvements to this experience. We will provide another update when we are ready to re-release on Current Channel. Thank you.
The change was introduced in version 2203 in early April 2022, with general availability in June 2022, as previously reported by BleepingComputer. This was a welcome and long-awaited change, as VBA macros are a popular method of pushing a wide variety of malware types (including Emotet, TrickBot, Qbot, and Dridex) through phishing attacks using malicious Office document attachments.
With the VBA macros blocked by default, everyone expected that attacks that delivered malware (such as information-stealing Trojans and malicious tools used by ransomware groups) would be automatically thwarted. On systems with VBA macro autoblocking enabled, customers will see a security warning “SECURITY RISK: Microsoft has stopped running macros because “the source of this file is not trusted”.
When clicked, the warning directs users to an article that provides information about the security risks behind using Office macros from threats and instructions on how to enable these macros, but only when absolutely necessary. While Microsoft has not shared the negative feedback that led to the return regarding this change, users have reported that they cannot find the Unblock button to remove Mark-of-the-Web from downloaded files, making it impossible to to enable. macros.
Source: Lega Nerd
