Security analysts have issued an urgent advisory about an active ransomware campaign that uses macro-enabled Excel files disguised as invoices to trick people into infecting their own devices. The attack relies on a familiar but still effective trick: a document that looks like a routine business invoice, paired with a prompt asking the recipient to "enable content" so a hidden macro can run. Once activated, that macro launches a script that downloads and installs ransomware, giving attackers the ability to lock files and demand payment.
While the technique itself is not new, the fact that it remains active and effective enough to warrant a fresh advisory shows how much social engineering still matters in modern cyberattacks. Technical defenses have improved dramatically over the years, but attackers keep finding success by targeting human judgment instead of software vulnerabilities.
How the Excel Invoice Scam Works
According to the advisory, the campaign centers on macro-enabled Excel documents, files that carry the .xlsm extension and are capable of running embedded scripts called macros. Macros were originally designed to automate repetitive tasks in spreadsheets, but they have long been abused as a delivery mechanism for malware because they can execute code the moment a user grants permission.
In this campaign, the malicious spreadsheets are dressed up to look like legitimate invoices, a format that naturally lowers a recipient's guard because it mimics routine business correspondence. When the file is opened, Excel typically shows a security warning and blocks macros by default. The attack only succeeds if the victim manually overrides that protection, usually because the document includes a fake notice claiming the content is unreadable unless macros are enabled.
Once that barrier is bypassed, the embedded macro triggers a script that reaches out to an external server, downloads additional malicious code, and deploys ransomware onto the victim's system. From there, files can be encrypted and held for ransom, disrupting personal data, business operations, or both depending on who is targeted.
Why Script-Based Delivery Is Hard to Catch
One reason this type of attack remains persistent is that script-based delivery can slip past some traditional detection tools. Rather than embedding the ransomware payload directly inside the Excel file, attackers use the macro as a launching pad that fetches malicious code separately. This staged approach can make the initial document appear less suspicious to automated scanning tools, since the truly harmful component isn't present until after the script runs.
This mirrors a broader trend in which attackers use layered or disguised methods to get malicious code past security software. In a separate case covered by vpn.social, Russian hackers used a fake nuclear prompt to trick AI scanners embedded inside a malicious script, another example of threat actors engineering their payloads specifically to confuse or evade automated defenses rather than relying on brute-force technical exploits alone.
What This Means For You
For everyday users and small businesses, this campaign is a reminder that ransomware doesn't always require a sophisticated technical exploit. It often just requires one person to click "enable content" on a file that looks legitimate. Invoices, receipts, and billing documents are especially effective lures because they create a sense of urgency or routine obligation, making people less likely to pause and scrutinize the file before opening it.
If your work or personal email regularly involves invoices, purchase orders, or financial attachments, this campaign is worth taking seriously. Ransomware deployed through a compromised device can spread to shared drives, cloud-synced folders, and connected networks, meaning a single unwary click can have consequences well beyond one computer.
Actionable Takeaways
Treat unexpected invoice attachments with caution, especially from unfamiliar senders or unfamiliar email addresses that mimic real vendors. Never enable macros in an Office document unless you are certain of its source and have a specific business reason to do so. Keep macro settings disabled by default in Excel and other Office applications, since most legitimate documents do not require them. Maintain regular, offline backups of important files so that ransomware cannot hold your only copies hostage. Keep endpoint security software and operating systems updated, since many detection tools are continuously refined to catch these evolving script-based delivery methods.
Ransomware campaigns like this one succeed by exploiting trust and routine, not just technical weaknesses. Staying alert to unexpected attachments, verifying senders before opening files, and keeping macros disabled by default remain some of the simplest and most effective defenses available to both individuals and organizations.
