This was just to prevent this specific attack - kind of a stopgap until the AV detects it properly. IIRC last time I checked the Word doc on virustotal it was

This was just to prevent this specific attack - kind of a stopgap until the AV detects it properly. IIRC last time I checked the Word doc on virustotal it was picked up 22/55. Fortunately at least AV did pick up the payload when a user let the macro run... Edit, ran it by virustotal again and got 28/55