scan.now
Premium Scan a site

Office document contains macros

The Office document contains VBA macro code, which runs with your user privileges as soon as you click Enable Content.

Do this: Open in Protected View and leave macros disabled. A macro is a program inside the document and runs as soon as you click Enable Content.
PassThe document contains no macro code.
HighThe document contains VBA macros.

The fix, in one snippet

Example to adapt Leave it disabled 
File > Options > Trust Center > Macro Settings >
  Disable all macros with notification

Illustrative values. Change the paths, hostnames and options to match your own site before using it.

The sections below explain what is tested, why it matters and the alternatives.

What we test

For OOXML files (.docm, .xlsm, .pptm, and .docx files that were renamed) the scanner lists the zip entries and looks for word/vbaProject.bin, xl/vbaProject.bin or ppt/vbaProject.bin, and for the application/vnd.ms-office.vbaProject content type. For legacy OLE files (.doc, .xls, .ppt) it walks the compound-file directory for a Macros or VBA storage. Excel 4.0 macro sheets (XLM), which are not VBA, are detected from xl/macrosheets/ or the BOUNDSHEET records. Where a VBA project is present, the streams are decompressed per the MS-OVBA specification and searched for auto-run names (AutoOpen, Document_Open, Workbook_Open) and suspicious calls (Shell, CreateObject("WScript.Shell"), URLDownloadToFile, powershell, Chr() arrays), which raise the severity.

Limits: nothing runs; heavily obfuscated macros may not decode fully; a legitimate business template with macros is still flagged, because the file format cannot express intent.

Why it matters

VBA has full access to the file system, the shell and the network. The classic lure shows a blurred page and a banner saying the document is "protected" and you must Enable Content; the macro then launches PowerShell to fetch the real payload. Emotet, Dridex and Qakbot were delivered this way for years. Since 2022 Microsoft blocks macros in files carrying the Mark of the Web by default, so attackers moved to ISO and LNK containers that strip the mark, and to social engineering that walks the victim through unblocking the file. Anyone who opens documents from email is exposed, most of all people on older Office versions or in organisations whose policy still allows macros.

How to fix it

Do not click Enable Content on a document you were not expecting; confirm with the sender by phone or chat, not by replying. Read the document in Protected View, which is the default for downloads, or open it in Word Online or Google Docs where macros do not run. You can confirm the finding yourself:

$ unzip -l report.docm | grep vbaProject
     9216  word/vbaProject.bin

If you need the macro for real work, verify the publisher and store the file in a Trusted Location rather than lowering global macro security. Administrators: enforce the "Block macros from running in Office files from the Internet" policy, allow only digitally signed macros and enable the attack surface reduction rule that blocks Office from creating child processes. Related: remote template check. Guides: Office macro malware and is this file safe?

Where this fits

Office document contains macros is check 10 of 20 that the file malware scanner runs under file structure and malware indicators, ordered the way they are worth fixing. That ordering is the point: Fixing this one while the check above it still fails buys less than it looks like.

Fix this one first

Above it in the same category sits Obfuscated or encoded script (high), where the script's code is deliberately hard to read: Encoded strings, character-code arrays or packed layers that hide what it does. An attacker who has that does not need this, so it is the better use of the same hour.

What fixing this still leaves open

Office document contains macros closes one route in. Immediately below it: Office document loads a remote template, where the document is attached to a template at a remote address, so opening it silently fetches content from an external server; PDF contains JavaScript, where the PDF contains JavaScript, which Adobe Acrobat and some other readers execute when the document opens or when an action fires; PDF contains launch or open actions, where the PDF contains an action that fires when the file opens or when you interact with it, such as launching a program, opening a URL or submitting form data.

Prompt for an AI Hand this check to an assistant Sign in to copy it
The first few lines 
You are a senior web engineer. I ran a security and SEO scanner against my site and it reported the finding below. Fix it properly rather than suppressing the symptom.

Finding: Office document contains macros (high severity)
Scanner check id: office-macro
18 more lines, including the evidence and the exact fix

The rest of this prompt names the pages and line numbers we found the problem on, the configuration to change, and the constraints a good answer has to respect. It is free, it just needs an account so the work is not scraped wholesale.

Sign in with Google

Signing in is free and takes one click. We store your email address and nothing else.

References

  1. Microsoft: Macros from the internet are blocked by default in Office
  2. Microsoft: [MS-OVBA] Office VBA File Format Structure
  3. MITRE ATT&CK T1204.002: Malicious File
  4. Microsoft: Attack surface reduction rules reference

Related guides

8 min read · Updated Sep 12, 2026 Office Macro Malware: Why 'Enable Content' Is Still the Most Dangerous Button

Word and Excel macros remain a leading malware delivery method because they run with your privileges. How macro droppers work, the newer...

Read the guide 8 min read · Updated Sep 16, 2026 Is This File Safe? A Step-by-Step Way to Judge a File Before Opening It

You have a file and you are not sure. This guide gives an order of checks: Where it came from, its real type, its hash, a scan, and the...

Read the guide