Which statement best describes Malicious Attachments in phishing campaigns?

• A. Microsoft Office documents with macros that download malware
• B. PDFs with embedded macros that download malware
• C. Excel workbooks with embedded formulas that execute malware
• D. Text files containing benign macros

Answer: (A)

The essential idea is that malicious attachments in phishing often rely on code that runs automatically inside a document. Microsoft Office macros (VBA scripts) stored in macro-enabled file types can execute when the user opens the file and enables macros, which attackers use to download and install malware. This makes Office documents with macros a classic and effective delivery method for malicious payloads in phishing emails.

PDFs can carry harmful payloads, but they don’t use the same macro mechanism as Office documents, and the phrasing specifically points to macros as the method. Excel formulas by themselves don’t execute malware; they don’t provide the same code-execution path as macros. Text files cannot contain or execute macros.