A macro-enabled Word document is a Microsoft Office file that can store VBA macros, which are small programs that run inside the document. Unlike a plain .docx file, a macro-enabled document usually uses the .docm format and can prompt the user to enable content before the code runs.
In cyber attacks, these files are common first-stage delivery tools because they turn a trusted attachment into code execution. An attacker may use a lure document to launch PowerShell, download a payload, or start a chain that leads to credential theft or remote control. Defenders reduce risk by blocking macros from the internet, restricting macro use to signed or approved documents, and monitoring for suspicious child processes from Office applications.