Coronavirus scams and nasty Word documents


Office for Mere Mortals
Your beginners guide to the secrets of Microsoft Office
Invalid email address
Tips and help for Word, Excel, PowerPoint and Outlook from Microsoft Office experts.  Give it a try. You can unsubscribe at any time.  Office for Mere Mortals has been running for over 20 years, we've never, ever revealed or sold subscriber details.  Privacy policy

No surprise that criminals are using Coronavirus/COVID-19 as a way to trick people into opening nasty Word document that could infect your computer.

All the usual suspects are trying to take advantage of Coronavirus to sell stuff. Plenty of fake ‘cures’ being touted, usually existing ‘miracles’ rebadged to take advantage of the unwary.

Just one example is reported by Sophos, it’s a variant on the Trickbot campaign and targets Italians.

The inner workings of the hacked .doc file are the same, all that’s changed is the wording of the email.  It’s supposed to come from a doctor passing along WHO recommendations for COVID-19.

coronavirus scams and nasty word documents microsoft word 35468 - Coronavirus scams and nasty Word documents

Source: SophosLabs

.DOC beware

As usual, the infected document is the old-style .DOC format – which should be a major ‘red flag’ that something is wrong.

‘This document was created in an earlier version of Microsoft Office Word’

A clever wording since that kind of warning occasionally does appear in Office.

Microsoft does NOT refer to ‘Microsoft Office Word’ using that phrase.

The copyright is another clever touch adding ‘corroborative detail’.

Instructions to bypass Office protections

The two instructions in the document are there to trick people into bypassing important protections in Office.

Enable Editing – takes the document out of ‘Protected Mode’ which is the default for incoming docs from email etc.

Enable Content – clicking that allows VBA scripts to run. In this case, it allows the code to infect your computer.

2019’s top software vulnerabilities featuring Microsoft Office

Coronavirus, Buttigieg and other topical words in Word & Office

Word’s Melissa virus is 20 years old – what’s changed?

Make your own Word virus for $40

 

subs profile e1563205311409 - Coronavirus scams and nasty Word documents
Latest news & secrets of Microsoft Office

Microsoft Office experts give you tips and help for Word, Excel, PowerPoint and Outlook.

Give it a try. You can unsubscribe at any time.  Office Watch has been running for over 20 years, we've never, ever revealed or sold subscriber details.  Privacy policy
Invalid email address