A macro-enabled document is an Office file, such as a Word or Excel document, that can store and run macros: small scripts that automate actions inside the application. These files are common in business workflows, but their ability to execute code makes them a security risk when opened from untrusted sources. Macros only run if the user enables them and if organizational policy allows it.
In cyber attacks, macro-enabled documents are often used as the first stage of infection. An attacker sends a convincing document that prompts the user to enable content, then the macro launches a script, downloads malware, or opens a hidden connection to an attacker-controlled server. Defenders reduce this risk by blocking macros from the internet, limiting Office child processes, using application allowlisting, and training users not to enable content in unexpected documents. In practice, macro control is a key layer for stopping phishing-based intrusion chains.