For all intents and purposes, macros are enabled by default. Yes, there's a simple "Click to enable" prompt. Everyone looks at it as "the button you need to cli

For all intents and purposes, macros are enabled by default. Yes, there's a simple "Click to enable" prompt. Everyone looks at it as "the button you need to click to load the document". People do it without even realising because it's so benign looking. Look at the Word document in this campaign, which is just one example of many: https://www.bleepingcomputer.com/news/security/new-trickbot-campaign-spamming-malicious-complaint-doc-attachments/ https://www.bleepingcomputer.com/news/security/new-trickbot-... I can only relate to the experience of sending out phishing tests that rely on users clicking "enable". Either the business has it disabled by a policy, or the success rate will be close to 100%.