Guide · Phishing

Enable-macros emails are phishing until proven otherwise

By Christopher Smith, MS Cyber Security, penetration tester·Published October 18, 2026·Updated October 18, 2026·5 min read

An email arrives with a spreadsheet attached: “Please enable macros / enable editing to view this invoice.” For a small business, that one click is still one of the most common ways a phishing email turns into malware, stolen logins, or a follow-on invoice scam.

Treat any unexpected macro prompt as phishing until you have verified the file through a second channel. This guide expands our Short on macro emails with the exact team rule, verification steps, and the controls that limit damage if someone clicks.

Quick verdict

• Default rule: never enable macros or editing on an unexpected attachment. View-only, or do not open it at all.
• Verify out of band. Call or message the sender on a number you already have — never the one in the email.
• Back the rule with controls: endpoint protection, automatic updates, MFA, and a password manager, so one click does not become a breach.

Why attackers still use macros

Macros are small programs inside Office files. Legitimate templates use them, which is why the prompt looks routine. Attackers copy that routine: the document shows a blurred “invoice” and a button that claims you must enable editing to see it. Enabling it can run code that downloads further malware or steals session tokens. Microsoft now blocks macros in files from the internet by default in many cases, but attackers adapt with prompts, zipped files, and instructions to move the file first — so the human rule still matters.

Verify first: a 2-minute routine

1. Stop at the prompt. Do not enable content to “just check.”
2. Look at the sender address and the story: unexpected invoice, payroll change, or urgent payment?
3. Contact the sender through a known channel and ask if they sent that exact file.
4. If it is legitimate, ask for a PDF or a copy through your normal shared drive instead.
5. Report or delete it through your email provider’s phishing button if it fails verification.

Controls that limit the damage

1. Endpoint protection on every laptop — see our endpoint protection guide for what business tiers add over consumer antivirus.
2. Automatic updates for Office, Windows/macOS, and browsers — see what to turn on.
3. MFA and passkeys so a stolen password alone is not enough — see MFA for Microsoft 365.
4. Email authentication (SPF, DKIM, DMARC) so attackers cannot easily spoof your own domain — see stop email spoofing.
5. QR and link phishing habits — the same verify-first rule applies to QR code phishing.

If someone already enabled macros

1. Disconnect that computer from Wi-Fi/network if you suspect malware, and tell whoever handles IT the same day.
2. From a clean device, change the affected passwords, revoke other sessions, and check MFA methods.
3. Check sent mail and mailbox rules for forwarding or auto-delete rules you do not recognize.
4. If payment details were involved, call the bank on a known number.

Bottom line

“Enable macros” on an unexpected file is not an IT detail — it is the attack. Close it, verify through a second channel, and let your endpoint, patching, and MFA controls carry the rest.

Free next step: Get the Small Business Cybersecurity Checklist — download it now, or sign up there to get it by email and hear about new guides.