Security attack

(Image credit: Shutterstock / ozrimoz)

Following the demise of macros in Microsoft Office (opens in new tab) files, it seems that another alternative method is gaining popularity, new reports have claimed.

Cybersecurity researchers from Deep Instinct have discovered an uptick in the use of Microsoft Visual Studio Tools for Office (VSTO) among cybercriminals, as they build malicious Office add-ins which help them achieve persistence and run malicious code on target endpoints.

What hackers are doing here is building .NET-based malware (opens in new tab), and then embedding it into an Office add-in, a practice that requires the threat actor to be somewhat more skilled. 

Bypassing antivirus

The method is hardly new but wasn’t as popular while Office macros were dominating. Now that Microsoft effectively eliminated that threat, VSTO-built threats are emerging in greater numbers. These add-ins can be sent together with Office documents, or hosted elsewhere and triggered by an Office document sent by the attackers. 

In other words, the victim still needs to download and run an Office file and the add-in in order to get infected, so phishing will still play a major role. That being said, the attack vector is still quite dangerous as it is capable of successfully working around antivirus programs and other malware protection services. In fact, Deep Instinct was able to create a working Proof-of-Concept (PoC) that delivered the Meterpreter payload to the endpoint. The video demonstration of the PoC can be found on this link (opens in new tab). The researchers said they were forced to disable Microsoft Windows Defender just to record the process. 

Meterpreter, a security product used for penetration testing, was easy for antivirus products to detect, however, all the elements of the PoC were not detected, they said.

In conclusion, the researchers expect the number of VSTO-built attacks to continue rising. They also expect nation-states and other “high caliber” actors to adopt the practice as well.

Via: BleepingComputer (opens in new tab)

Sign up to theTechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.

The post Microsoft Visual Studio add-ins could be used to deliver malware first appeared on

New reasons to get excited everyday.

Get the latest tech news delivered right in your mailbox

Microsoft Visual Studio add-ins could be used to deliver malware

5 Reasons Why You Should Try Online Horse Race Betting

In many places around the world, horse races are an attraction that a lot of people love to watch. With the fast-paced action and thrill that each game provides, it is no longer surprising to know that millions of fans have grown fond of it.
Microsoft Visual Studio add-ins could be used to deliver malware

NordLayer — more than a business VPN

Cybersecurity threats have become vast and more sophisticated. The rate of malware attacks and malicious activity counts within seconds despite the size or sector the organization belongs to — no one is safe enough to expect that foe actors will bypass vital company resources.

Microsoft Visual Studio add-ins could be used to deliver malware

You may also like

Notify of
Inline Feedbacks
View all comments

More in computing