Here’s why you should be wary of Microsoft Word attachments right now

Digital security firm McAfee has discovered a “zero day” flaw in Microsoft’s Office software that leaves users vulnerable to damaging malware attacks.

In a blog post (via) over the weekend, McAfee revealed RTF files with Microsoft Word’s .doc extension name have been used to gain unauthuorised access to machines as far back as January 2017.

The firm said the exploit, which executes a malicious code from a remote server, affects all versions of Office, including Office 2016 for Windows 10.

Related: Office 2016 review

Until then, McAfee advises users to use the Office Protected View, while warning against opening Office files from “untrusted locations”.

The damaging bug enables attackers to gain “full code execution” on the the affected computer, rendering the owner powerless.

In the blog post McAfee explains: “The exploit connects to a remote server (controlled by the attacker), downloads a file that contains HTML application content, and executes it as an .hta file. Because .hta is executable, the attacker gains full code execution on the victim’s machine. Thus, this is a logical bug, and gives the attackers the power to bypass any memory-based mitigations developed by Microsoft.

“The successful exploit closes the bait Word document, and pops up a fake one to show the victim. In the background, the malware has already been stealthily installed on the victim’s system.”

Take care out there folks, and be sure to pay close attention to those emails before opening attachments willy nilly.

How much do these attacks concern you? Share your thoughts in the comments below.