# One Click Office Exploit – Introducing the Office Exploit Builder

**URL:** <https://onehack.st/t/one-click-office-exploit-introducing-the-office-exploit-builder/166616>\
**Category:** Discussion & Solutions\
**Tags:** hacking\
**Created:** [December 17, 2020, 6:20pm UTC](https://onehack.st/t/one-click-office-exploit-introducing-the-office-exploit-builder/166616 "2020-12-17T18:20:48Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![str8diah](https://onehack.st/user_avatar/onehack.st/str8diah/32/52083_2.png) [@str8diah](https://onehack.st/u/str8diah)\
**Post date:** [December 17, 2020, 6:20pm UTC](https://onehack.st/t/one-click-office-exploit-introducing-the-office-exploit-builder/166616/1 "2020-12-17T18:20:48Z")

</div>

A new threat called “office exploit builder” allows attackers to generate stealth MS Office files (Word & Excel formats) with macros to download and execute malicious code on a victim’s machine.

**Cybercriminals are increasingly using this “office exploit builder” and similar exploit builders. As a launching pad for attacks, these methods have proven successful time after time, because they require very few resources from the attacks while keeping their exposure minimal and almost completely undetectable.**

![]()

Once the attachment is opened, a security warning is shown if macros are disabled on the victim’s machine. Upon clicking “enable content”, the malicious code executes.

Checking the document in virus total shows an impressive 11/55 detection ratio, making most AV vendors and security companies inefficient to this threat at the moment.