As an added bonus, the method demonstrated in this video works even when Excel Add-In's are explicitly disabled and the relevant file types blocked within the Excel Trust Center.

In the attached video, we can see that we are no longer able to run an XLL by double clicking it after extracting it from the zip file and looking at it's properties, we find that the Mark Of The Web has been applied to the file which means Excel will refuse to open it.Īs the video shows, with a few extra steps and some social engineering, XLL's are still alive and well when it comes to phishing for access. XLL's have been a favorite of mine since I published my research on them almost a year ago ( ), so I wanted to see how the security update impacts XLL's as it relates to using them to deliver and run malware. It sounds like they need to advertise this feature as being in beta. Then instead of 300 manual changes you have 300 manual password resets. Microsoft recently rolled out a security update which is live for those running M365 Insider Preview to protect users from malicious XLL (Microsoft Excel Add-In's) files originating from the internet (see BleepingComputer's article: ) Be very careful when using this feature, in the past there were stories about lastpass setting different password than was saved when auto-changing password.

Lastpass auto login