Macro malware is malicious code embedded in document macros, most often in Microsoft Office files. Macros are small scripts designed to automate repetitive tasks, but attackers abuse them to run commands, download payloads, or launch additional malware when a document is opened and macros are enabled. This makes the document itself a delivery vehicle for intrusion.
It matters because macro malware turns a trusted productivity feature into an attack surface. Defenders commonly block internet-sourced macros, monitor Office child processes, and inspect documents for suspicious automation. In real attacks, macros may lure users with a fake invoice or report, then trigger scripts that reach out to a server, disable protections, or start a payload chain. Security tools also watch for macro-based activity because it is a common first step in phishing and can be used to test endpoint controls or trigger remediation workflows.