Excel macros: what they are, their risks and how to open XLSM files safely

You receive a file ending in .xlsm and, when you open it, Excel shows a yellow or red bar talking about macros and security. Do you click the button to enable them or close the file? The answer depends on who sent it, what it’s for and what the code inside actually does.

Here you’ll see what a macro is, which formats can carry them, why they’re so often used to slip in malware and which steps to follow to open an XLSM file without putting your computer or your data at risk.

What a macro is and what it’s used for

A macro is a small program stored inside the workbook that automates repetitive tasks. In Excel they’re almost always written in VBA (Visual Basic for Applications), the language you’ll see if you open the editor with Alt + F11. Some legitimate and very common uses:

• Formatting a report with a single click.
• Importing data from several files and consolidating it on one sheet.
• Generating invoices or delivery notes as PDF from a template.
• Validating internal forms before they’re sent.

The problem is that VBA isn’t limited to the spreadsheet. A macro can create and delete files, launch other programs, connect to the internet or download executables. That power is what makes it useful and, at the same time, dangerous.

Which formats can contain macros

The file extension is the first clue. Since Excel 2007, Microsoft has kept macro-enabled and macro-free formats separate so you know what to expect before opening anything:

Note that the old .xls format also supports macros, even though its name doesn’t say so. There are also Excel 4.0 (XLM) macros, a system older than VBA stored in special sheets that are sometimes hidden. Current versions of Excel block them by default.

Why macros are a risk

For years, Office documents with macros have been a classic way to spread malware by email. The pattern tends to repeat itself:

1. You get an email that looks normal: an invoice, an order, a payslip or a shipping notice.
2. The attachment is an Excel file whose content looks blurry or empty, with a message asking you to enable content to see it.
3. Once enabled, the macro runs, usually when the workbook opens, and downloads or launches another program.

Warning signs to keep in mind:

• You weren’t expecting the file, or the sender is unknown or has an odd address.
• The document insists that you enable macros or content in order to read it. A normal sheet doesn’t need that.
• It contains simple data, such as a price list, but arrives as .xlsm or .xls.
• The attachment comes in a password-protected archive and the email gives you the password. It’s a trick to stop the mail server’s antivirus from scanning it.

How Excel protects you by default

Protected View

Files downloaded or received as attachments open in Protected View: you can read them but not edit them, and no code runs. It’s the ideal moment to look at the content safely.

Macros disabled with notification

If you leave Protected View, the usual setting disables macros and shows a yellow security warning bar with an Enable Content button. As long as you don’t click it, the macros won’t run.

Blocking macros from the internet

In Microsoft 365 and recent versions, files marked as coming from the internet have their macros blocked entirely: a red security risk bar appears and there’s no longer a button to enable them from the warning itself. If the file is trustworthy, you have to unblock it explicitly, as you’ll see below.

How to open an XLSM file safely

Follow this order whenever you receive a workbook with macros:

1. Verify the source through another channel. If a supplier sends you an .xlsm you weren’t expecting, call them or write to them separately before opening it.
2. Scan the file with your antivirus before opening it.
3. Open it without enabling anything. Stay in Protected View or with macros disabled and check whether the content makes sense.
4. Look at the code with Alt + F11 (explained below) to find out what the macro does.
5. Unblock it only if you trust it: close Excel, right-click the file in Windows File Explorer, choose Properties and, on the General tab, tick Unblock.
6. Enable content only after all of the above.

If you only need the data, don’t enable anything: copy what you need or save a copy with File › Save As › Excel Workbook (*.xlsx). Excel will warn you that the VBA project can’t be saved in a macro-free workbook; accept and you’ll get a clean file. Another option is to open it in Excel for the web, which doesn’t run VBA macros.

Reviewing the code without running it

With macros disabled, press Alt + F11 and go through the modules in the project pane, including ThisWorkbook and each sheet. Be suspicious if you find:

• Procedures that run on their own when the file opens, such as Workbook_Open or Auto_Open.
• Calls to Shell, CreateObject, PowerShell or URLDownloadToFile.
• Long strings with no apparent meaning, a sign of obfuscated code.
• A password-protected VBA project in a file that shouldn’t have anything to hide.

Adjust the Trust Center

Macro settings are under File › Options › Trust Center › Trust Center Settings › Macro Settings. Some recommendations:

• Keep the option to disable VBA macros with notification. It’s the sensible balance for most users.
• Never choose to enable all macros: any file could run code without asking you.
• If you use your own macros every day, store them in a folder added to Trusted Locations, and don’t mark general folders such as Downloads as trusted.
• In companies, macros digitally signed by a trusted publisher are the safest way to distribute automations.

A common mistake: enabling macros in a file because last time it was safe. Every file is different, even from the same sender, because their email account could have been compromised.

Share your files without unnecessary risks

When you’re the one sending the file, spare the recipient trouble: if the macros aren’t essential for them, send a copy as .xlsx. If you have old workbooks in .xls, converting them with our tool to convert XLS to XLSX leaves you with a format that can’t run macros. And if the file contains sensitive data, you can add an opening password for free from your browser. Remember to send that password through a different channel from the file and to warn the recipient beforehand, so they don’t mistake it for a suspicious attachment.

Conclusion

Macros are an excellent tool for automating work, but they’re also a well-known attack vector. The practical rule is simple: don’t enable content in a file you weren’t expecting, be wary of any document that asks you to do so in order to display properly and, if you only need the data, save it as .xlsx. With Excel’s default settings and a bit of judgment, opening an XLSM file stops being a gamble.

Frequently asked questions