Misusing dynamic data exchange (DDE)

Apart from using macros in MS Office documents, there is another, less common way to execute code. In this case, attackers rely on the DDE functionality. One way to do it is to use the DDEAUTO statement (currently disabled by default). Another option recently used to spread the cross-platform Adwind RAT is to abuse the functions logic implemented in Microsoft Excel. Please follow the Chapter 9, Scripts and Macros: Reversing, Deobfuscation, and Debugging for more information. Attackers can always try to utilize social engineering tricks in order to make the user enable any required functionality.