Free tools Windows power users keep installed
One-click scans. No signup required.
A macro virus is malicious code written in an application’s macro language and embedded in a document. When a compatible application handles the document, the macro can run; some macro viruses can then infect other documents or application templates. Today, the broader term macro malware also covers malicious macro activity that does not necessarily replicate like a virus.
What is a macro virus?
NIST defines a macro virus as “a specific type of computer virus that is encoded as a macro embedded in some document and activated when the document is handled.” Unlike a virus that runs as a conventional executable, a macro virus uses code understood by a host application, such as a word processor or spreadsheet program. NIST classifies macro viruses as interpreted viruses; scripting viruses, by contrast, are written for an operating-system service. NIST CSRC glossary and NIST SP 800-83 describe these distinctions.
As an Amazon Associate I earn from qualifying purchases.
Macro virus and macro malware are not identical terms
A virus is malware capable of propagation. “Macro malware” is a broader practical term for malicious use of macro functionality; it does not require the code to replicate by infecting other documents. A harmful Office document is therefore not automatically a macro virus in the strict sense.
How does a macro virus spread?
A document may carry macro code that runs when opened or otherwise handled by a compatible application. A virus can copy itself into other documents or an application template. NIST describes how an infected template can in turn affect documents created or opened with it. Sharing infected files can spread the code between people and systems. NIST SP 800-83 discusses this mechanism.
#1 Best Overall
- SPEED-OPTIMIZED, CROSS-PLATFORM PROTECTION: World-class antivirus security and cyber protection for Windows (Windows 7 with Service Pack 1, Windows 8, Windows 8.1, Windows 10, and Windows 11), Mac OS (Yosemite 10.10 or later), iOS (11.2 or later), and Android (5.0 or later). Organize and keep your digital life safe from hackers
- SAFE ONLINE BANKING: A unique, dedicated browser secures your online transactions; Our Total Security product also includes 200MB per day of our new and improved Bitdefender VPN
- ADVANCED THREAT DEFENSE: Real-Time Data Protection, Multi-Layer Malware and Ransomware Protection, Social Network Protection, Game/Movie/Work Modes, Microphone Monitor, Webcam Protection, Anti-Tracker, Phishing, Fraud, and Spam Protection, File Shredder, Parental Controls, and more
- ECO-FRIENDLY PACKAGING: Your product-specific code is printed on a card and shipped inside a protective cardboard sleeve. Simply open packaging and scratch off security ink on the card to reveal your activation code. No more bulky box or hard-to-recycle discs. PLEASE NOTE: Product packaging may vary from the images shown, however the product is the same.
Macro malware is commonly delivered in Office files attached to email or inside ZIP archives. A message may disguise an attachment as an invoice, receipt, or legal document, then urge the recipient to enable macros—sometimes using a fabricated warning. Microsoft says the need for a user to enable macros in recent Office versions has changed the way these attacks commonly work compared with earlier periods when automatic execution made them more common. Microsoft’s macro-malware overview describes these delivery tactics.
Microsoft has cited malware families that macro malware has downloaded, including Swappa ransomware, Teerac ransomware, Chanitor, Ursnif, Fynloski, and Gamarue. These are examples Microsoft has observed, not a current ranking of prevalence.
Rank #2
![Norton 360 Deluxe 2027 Antivirus, 5 Devices, Auto-Renews [Download]](https://m.media-amazon.com/images/I/41IYV5zGyCL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 5 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
Which files can contain macros?
In Microsoft 365, the file extension is a useful clue to whether a Word, Excel, or PowerPoint file can contain embedded macros:
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →| Application | Macro-capable format | Format without embedded macros |
|---|---|---|
| Word | .docm |
.docx |
| Excel | .xlsm |
.xlsx |
| PowerPoint | .pptm |
.pptx |
These are the extensions identified by Microsoft Support. An extension is only a clue, not proof that a file is safe: it does not establish who sent the file or whether its contents are trustworthy. Microsoft also uses “active content” to include items such as ActiveX controls, COM add-ins, and Microsoft 365 add-ins, so not every active-content warning refers to a macro.
Rank #3
![Norton 360 Premium 2027 Antivirus, 10 Devices, Auto-Renews [Download]](https://m.media-amazon.com/images/I/41JNWru8mYL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 10 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
Do macros run automatically in current Office versions?
Microsoft says macros are disabled by default in recent Office versions. Its Microsoft 365 guidance says active content generally does not run automatically unless a file is trusted or opened from a trusted location. An attacker may still try to persuade someone to enable it. Microsoft Learn and Microsoft Support explain these protections and warnings.
When an Office warning offers an “Enable Content” choice, do not select it just to view an unexpected document. Microsoft Support advises: “Do not select Enable Content unless you’re certain that you know exactly what that active content does, even if the file appears to come from a person or organization that you trust.” A familiar sender name alone does not verify the attachment.
Rank #4
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
How can you reduce the risk?
- Leave macros disabled when a task does not require them.
- Do not enable content in an unexpected attachment simply to read it; verify the request with the sender through a separate, trusted channel if a macro-enabled file is genuinely expected.
- Be cautious with Office files in unexpected emails and ZIP archives, especially when a message pressures you to enable content.
- Keep anti-malware protection current. Microsoft says modern anti-malware software should detect and block known macro viruses, but no single measure guarantees protection.
Microsoft 365 itself does not scan files or locations to find and delete macro viruses. For organizations, administrators can configure macro defaults and use Attack Surface Reduction rules to prevent macro malware from launching executable content. These controls add a layer of defense; they do not remove the need for cautious handling. Microsoft Support and Microsoft Learn cover these points.
What is known about macro viruses today?
The NIST guide describes historical propagation mechanisms and names Concept, Marker, and Melissa as notable examples in that historical context. Those examples should not be read as evidence that these are current active threats. The cited authoritative sources do not establish a current prevalence figure for macro viruses, so a present-day rate or ranking cannot be inferred from them. NIST SP 800-83 is useful here for technical classification and historical behavior, while Microsoft’s macro-malware overview was last updated on April 24, 2024, and its Support guidance was accessed October 7, 2026.
Quick Recap
Best Value
- POWERFUL, LIGHTNING-FAST ANTIVIRUS: Protects your computer from viruses and malware through the cloud; Webroot scans faster, uses fewer system resources and safeguards your devices in real-time by identifying and blocking new threats
- IDENTITY THEFT PROTECTION: Protects your usernames, account numbers and other personal information against keyloggers, spyware and other online threats targeting valuable personal data
- REAL-TIME ANTI-PHISHING: Proactively scans websites, emails and other communications and warns you of potential danger before you click to effectively stop malicious attempts to steal your personal information
- ALWAYS UP TO DATE: Webroot scours 95% of the Internet three times per day including billions of web pages, files and apps to determine what is safe online and enhances the software automatically without time-consuming updates
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
