Spotting macros and active content in Office files
Say a small-business owner — call her Linda — gets an email with an "updated invoice" attached. It's a Word file from a name she half-recognises. When she opens it, a yellow bar asks her to "Enable Content." That bar is the whole game: behind it can be a macro — code that runs the moment you allow it.
Why macros matter
Office documents can carry embedded code (VBA macros) that executes when opened and enabled. It's a classic way malware arrives — dressed up as an invoice, a résumé, or a form you were expecting. The document looks like an ordinary document; the danger is the code you can't see.
Beyond macros, Office and PDF files can also hide auto-run actions, embedded files, and links designed to fire without a click.
Check before you enable anything
Before you click "Enable Content," check the file with scrub. It reads the document on your own device — nothing uploaded, nothing executed — and flags embedded macros, comments, hidden text, and identifying metadata, giving you a plain Suspicious or Clean verdict. If a plain-looking invoice is carrying a macro, you'll know before you run it.
An honest note
scrub is a hidden-content scanner, not antivirus. It tells you an Office file contains a macro or active content so you can decide whether to trust it — a powerful "look before you leap." It doesn't analyse what the code does or replace endpoint protection. If a document you didn't expect wants you to enable content, the safest answer is usually no.
When in doubt, check first. Get scrub free.