You open an invoice in Word and catch a trojan: 26% arrive this way

Researchers examined threats in corporate networks from autumn 2025 onwards. Traffic analysis showed malware activity in 75% of the organisations studied. In the first half of 2026, malicious programs were used in 65% of successful attacks on companies, helping intruders get into the infrastructure, establish a foothold and develop the intrusion.

About half of the malware found were trojans: programs that execute commands without the user's knowledge, download further components, steal data or open remote access. That high share shows the malicious file is rarely the attack itself — it is the first link in a longer chain.

The reason is familiarity. Employees receive spreadsheets, reports, contracts and other attachments every day, so an office file looks less suspicious than an unknown program. A message with a document fits into normal correspondence, and the start of an attack is lost among routine work.

Technically, execution relies on macros, external templates, embedded objects and exploits. A malicious document either runs code itself or fetches the next component once opened.

Microsoft has spent years closing off dangerous Office capabilities, including automatic execution of VBA macros in documents that came from the internet. The restrictions work, but they change tactics: attackers look for other ways to run code, use vulnerabilities and multi-stage delivery.

A recent example appeared in February 2026, when Positive Technologies recorded an attack on Russian organisations through RTF documents disguised as business correspondence. The attachments contained an OLE object, and CVE-2026-21509 allowed the attacker to bypass built-in Office protection when OLE components were processed. The victim only had to open the prepared file. The flaw scored 7.8 on CVSS and entered the CISA catalogue of actively exploited vulnerabilities.

Office files remain valuable for sophisticated groups too. In attacks detected in the second quarter of 2026, malicious templates were loaded over HTTP from compromised legitimate sites. That separates the initial document from the main payload and makes the whole chain harder to detect.

After the first stage, standard system tools and legitimate programs take over. The attacker moves to components present in any corporate environment, and each individual action looks like ordinary work by a user or an administrator. Checking a single file therefore does not always help: suspicious connections and data transfers only show up in network behaviour analysis.

The measures are well known; the question is whether they are finished in a given company.

• A sandbox for unknown attachments: the document runs in an isolated environment while the security system watches which processes and files it creates, what it changes and where it connects.
• Timely Office updates: the example above worked precisely because a patch was missing.
• Filtering mail attachments by type and content, including RTF and files carrying external templates.
• Monitoring network activity after a file is opened: an office application reaching an unfamiliar domain is a signal in itself.
• Training staff on real examples: macros and "enable editing" prompts are only recognised by someone who has seen them before.

The main finding is not the percentage but the role of the document: it is almost never the attack, it is the opening. That changes what defence has to cover — checking the attachment is not enough without watching what happens on the network afterwards.