Microsoft to Block Excel XLL Add-Ins to Stop Malware Delivery

Microsoft has declared plans for its 365 shoppers to routinely block all XLL add-in files downloaded from the internet to reduce phishing attacks relying on these forms of lures.

Creating on its Microsoft 365 roadmap webpage, the tech huge has verified it intends to carry out these plans by March 2023.

“To battle the raising amount of malware attacks in latest months, we are utilizing actions that will block XLL include-ins coming from the internet.”

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

In accordance to Dave Storie, adversarial collaboration engineer at Lares Consulting, the abuse of Microsoft include-ins by adversaries is a procedure that has been made use of by risk actors for many years to execute destructive code.

“The Microsoft Workplace Suite is an interesting mechanism for adversaries to carry out attacks owing to its ubiquity in company environments and private machines,” Storie advised Infosecurity through email. “The widespread deployment of the Place of work suite can enable risk actors to get a lot of mileage out of their malware.”

The security qualified also added that the current increase in the distribute of destructive Microsoft add-ins is quite possibly related to the latest hardening of macros applied by Microsoft in the Workplace Suite last yr.

“When businesses like Microsoft minimize the attack surface area or otherwise boost the work required to execute an attack on their item offerings, it forces menace actors to take a look at alternate avenues,” Storie explained. “This typically potential customers to exploring earlier known, most likely significantly less best, choices for danger actors to achieve their targets.”

Mike Parkin, a senior complex engineer at Vulcan Cyber, echoed Storie’s position but extra that even though the element is welcome, it also details out how normally destructive actors abuse the Business office suite’s capabilities.

“Unfortunately, it’s unclear at this level whether [the new feature is] just heading to be a warning that users can easily click on via, a additional proactive ‘off by default’ location, or whether they are heading to disable it totally for XLL data files downloaded from the internet,” Parkin instructed Infosecurity in an email.

The Microsoft announcement will come months following France’s electronic privacy regulator fined the US tech large €60m ($65.18m) over advertising cookies.