A macro warning is a security prompt shown by office software before a document runs embedded automation, such as macros, scripts, or other active content. Its purpose is to slow down execution and give the user a chance to judge whether the file is trusted. In practice, attackers often use convincing spreadsheets or word-processing files to pressure users into opening or enabling content, because a single click can turn a document into a launch point for code execution.
Macro warnings matter because they are one of the main defenses between a passive file and an active threat. But they are not a complete guarantee: some attacks use alternate execution paths that do not trigger the warning, or abuse features that users do not recognize as macros. Defenders reduce risk by disabling unnecessary automation, restricting document scripting, and treating unexpected prompts as suspicious rather than routine.