That is the case with a new PowerPoint malware, which was discovered security company Trend Micro. This particular attack merely needs users to hover over a link with their mice in order to install a banking Trojan that has remote access, network traffic monitoring, information access, and other nefarious capabilities.
The Trojan is delivered to users in a spam email with a PowerPoint Show (PPS) or Open EML Slide Show (PPSX) file attached. These files are different from the usual PowerPoint files (PPT and PPTX) in that they can not be edited and they only open in presentation or slideshow modes.
Malicious links are embedded in the PowerPoint slides that use the mouseover action to execute code that seeks to install the Trojan. For users with Protected View turned on in later versions of Microsoft Office, a security prompt pops up that the user must click through in order to enable the installation. As usual, users should never click “Enable” in such dialog boxes unless they are absolutely certain of what is actually going to run. Needless to say, clicking “Enable All” almost universally a bad idea.
On older versions of Office, however, or those without Protected View turned on, then the installation proceeds without any notice to the user or need for anything to be actively enabled. That makes this particular piece of malware particularly insidious and difficult to protect against. Note that Office 365’s web mode and PowerPoint Online are not affected by the attack.
The lesson here, first, is to make sure that Protected View is turned on in your Office applications. You can check on this by going to File, then Options, then Trust Center then click on the Trust Center Settings button. There, you want to select Protected View and make sure all of the options are checked. You can also look at your Macro settings while you are there and turn those off unless you’re sure you need them — Office Macros are another vector of attack.
It is bad enough that our machines can be infected by hackers who trick us into clicking on links and running programs. The fact that we can get infected without doing anything at all is even worse — and means we need to be even more vigilant in ensuring that all of the various security features for our software and hardware are turned on and properly updated.
