An accounts-payable clerk receives a message with a spreadsheet named "Remittance advice." She opens it and sees a blurry page that says the document is protected and she must click "Enable Content" to view it. She clicks. There is nothing to view, because the only real content was the macro that just ran, and a minute later her workstation is calling out to a server she has never heard of.
Attachments and browsers are two of the most productive vectors because both involve the user opening something that can carry executable code. On the CompTIA Security+ SY0-801 exam, objective 2.3 lists attachment-based vectors, embedded macros, Rich Text Format documents and PDFs, and browser-based vectors, extensions, JavaScript, password managers, cookies and session tokens. This lesson covers how each delivers an attack, what it looks like, and the primary defense. The malware these vectors go on to deliver, including fileless techniques, is covered in the malware section; here the subject is the route in.
Attachment-based vectors rely on the file the user opens
An attachment-based vector hides the attack inside a file a person is expected to open. The file arrives as an email attachment, a chat upload, or a download, and it looks like ordinary business: an invoice, a resume, a contract, a report. The trick is that several everyday document formats can carry or trigger code, so opening the file is enough to start the attack, or one small extra click is.
The objective names three formats, all trusted, routine, and more dangerous than they appear: documents with embedded macros, Rich Text Format files, and PDFs. The general defenses apply to all of them, so it helps to state them once. Patch the applications that open these files, since many attacks exploit a flaw in the reader. Open untrusted documents in a sandbox or protected view that blocks active content. Use attachment filtering at the mail gateway to strip or detonate risky file types. And rely on Mark of the Web, the flag the operating system attaches to files downloaded from the internet, which modern Office and readers use to open such files in a restricted mode.
Embedded macros turn a document into a program
A macro is a small program embedded in an Office document, written in a language called VBA, originally meant to automate repetitive work in Word, Excel or PowerPoint. Because a macro can run commands, read and write files, and reach the network, a malicious macro turns the document into a launcher for the real payload. For years this was one of the most common ways malware arrived.
What the user sees is the document opening in a restricted "protected view" with a warning bar, usually reading "Enable Content" or "Enable Editing." The attack depends on social engineering to get past that bar: the document claims it was created in a different version, or that content is hidden until editing is enabled, so the user clicks the button that lifts the block. The moment they do, the macro runs.
The defense that changed this most is blocking macros in files that came from the internet. Modern Office uses Mark of the Web to identify internet-sourced documents and refuses to run their macros by default, showing a blocked-content message with no easy override. Organizations can enforce this through policy, and can disable VBA macros entirely where they are not needed. On the exam, a document that asks the user to "enable content" and then compromises the machine is the embedded-macro vector, and the matching control is blocking macros from internet-sourced files.