Microsoft announced plans to automatically block all XLL add-in files downloaded from the Internet by 365 customers to prevent phishing attacks that rely on these types of lures.
Write to the Microsoft 365 Roadmap pagethe tech giant has confirmed it intends to implement these plans by March 2023.
“We have taken steps to block XLL add-ins from the Internet to combat the increasing number of malware attacks in recent months.”
According to Dave Storie, Adversarial Collaboration Engineer at Lares Consultingexploiting Microsoft add-ins by adversaries is a technique that has long been used by attackers to execute malicious code.
“Because of its ubiquity in corporate environments and personal machines, the Microsoft Office Suite is an attractive mechanism for adversaries to carry out attacks,” Storie said. Information security on mail. “The widespread deployment of the Office suite gives attackers a lot to gain from malware.”
Security experts also believe that the recent increase in the spread of malicious Microsoft add-ins is due to the recent Macro enhancement It was implemented in the Office suite by Microsoft last year.
“When organizations like Microsoft reduce their attack surface or increase the effort required to carry out attacks against their products, attackers are forced to look for alternatives,” Storie explains. . “This often leads to investigation of previously known and possibly less than ideal options for attackers to achieve their objectives.”
said Mike Parkin, senior technical engineer at vulcan cyberagreed with Storie’s point, adding that while the feature was welcomed, he also noted how often malicious actors abuse features in the Office suite.
“Unfortunately, at the moment, [the new feature is] It could be a warning that users can easily click through, a more aggressive ‘off by default’ setting, or a warning to completely disable XLL files downloaded from the Internet,” Parkin said. Information security on mail.
Microsoft’s announcement comes a few weeks after the French digital privacy regulator. U.S. tech giant fined €60 million ($65.18 million) advertising cookies.
