Microsoft Excel update is offering some welcome extra security protection
Microsoft encourages other antivirus products to use its new protection mechanism
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
Microsofthas announced that it has broadened the scope of the Antimalware Scan Interface (AMSI) withOffice 365to hunt forExcel 4.0(XLM) macros.
The move is the result of an increase in XLM-basedmalware. Interestingly, XLM is Excel’s legacy macro language that was replaced with Visual Basic for Application (VBA) in the early 1990s.
“This integration, an example of the many security features released for Microsoft 365 Apps on a regular basis, reflects our commitment to continuously increase protection for Microsoft 365 customers against the latest threats,” share three members of different security teams in a joint post.
Victim of its own success
Microsoft is in a way somewhat a victim of its own success here, as according to the post, the release of AMSI in 2018 stripped macro-malware of its destructive powers.
As AMSI mastered the art of blocking malicious macro scripts written in VBA, threat actors behind wide-spread trojans and malware including Trickbot, Zloader, and Ursnif, were forced to switch to the abandoned, but still supported, and quite powerful XLM.
“Cybercriminals know this, and they have been abusing XLM macros, increasingly more frequently, to call Win32 APIs and run shell commands,” the developers write. With its new capabilities, AMSI has now also nullified XLM macro-based attacks.
The developers point out that AMSI data is leveraged by allMicrosoft Defenderfor Endpoint products including Microsoft DefenderAntivirus, which is the built-in antivirus solution onWindows 10. When it detects a malicious XLM macro, it’ll prevent its execution and even terminate Excel to block the attack completely.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
“Because AMSI is an open interface, other antivirus solutions can leverage the same visibility to improve protections against threats,” the developers conclude inviting other security vendors to leverage AMSI in their antivirus solutions.
With almost two decades of writing and reporting on Linux, Mayank Sharma would like everyone to think he’sTechRadar Pro’sexpert on the topic. Of course, he’s just as interested in other computing topics, particularly cybersecurity, cloud, containers, and coding.
Phishing attacks surge in 2024 as cybercriminals adopt AI tools and multi-channel tactics
This new phishing strategy utilizes GitHub comments to distribute malware
Arcane season 2 finally gave us the huge Caitlyn and Vi moment we’ve been waiting for – and its creators say ‘we couldn’t have done it in season one’
