PENTESTY · EDITORIAL ANALYSIS · · 4 min read
Excel and freelancers: who approved what the spreadsheet asks to execute?
A professional conversation can deliver a file requesting actions beyond the task. The workflow needs to preserve that boundary without relying on the sender's assurances.
By Pentesty
The allegation's number and the period investigated
In a September 1, 2026 announcement, DOJ described an indictment alleging malware distribution through Excel attachments to approximately 80,000 users of a freelance employment platform between 2016 and 2017. That is the reach alleged in the indictment, not individual confirmation of 80,000 infections. The announcement reports extradition and a court appearance in 2026, not a new campaign that year. The allegations require proof; the platform was not identified.
Does the task require data or an automated process?
Imagine someone hired to review products who receives a spreadsheet asking them to enable a feature to view requirements. Before an exception, the owner should explain whether the task needs data reading or an assessed automated process. The sender's request cannot make that decision alone.
Agree on accepted formats, the delivery channel and a way to confirm unexpected changes. Offer a route to request a version compatible with the activity, without active code when it is unnecessary. Security centered on the actual task helps assess whether the alternative allows work to continue rather than merely providing an instruction people struggle to follow under normal working conditions.
Check policy in the environment actually opening the file
Microsoft's internet macro documentation describes behavior for Office on Windows, with differences involving versions, file origin and trust decisions. That behavior should not be generalized to Mac, mobile applications or Office on the web. The document also shows that trusted locations and other exceptions influence execution. Verify the environment used rather than assuming a universal block.
Record the application, version, managed device and delivery route. A policy defined for employees may not reach a contractor's personal workstation. Decide which deliverables should remain in a company-administered environment and how external workers receive support. Connect that decision to Microsoft 365 lifecycle planning, because changing versions also calls for checking the workflow again and confirming who owns any resulting exception.
Exercise an ordinary delivery and an exception request
Use test accounts and a spreadsheet created by the team, without campaign material. If macros are in scope, a specialist can prepare a harmless action that only displays a marker, without networking, credentials or personal information. Agree the expected outcome before the exercise and follow delivery through task completion. Do not instruct participants to remove protections to make the assessment work.
- Delivery: record the channel, test file and environment where the team attempted to open its content.
- Decision: check the policy outcome and who can assess a requested exception.
- Work: verify that the person can complete the task through the approved route without executing the unauthorized action.
- Retest: retain minimal evidence, address the identified gap and repeat the scenario under the same conditions.
An exception should end when its justification ends
Where legitimate automation is necessary, assign an owner, purpose and review condition. Check who can replace the approved file and whether a change requires new acceptance. Avoid turning the solution for one deliverable into permanent trust in every document passing through the same location. The exercise should observe both the expected denial and the specifically authorized operation rather than treating either result alone as sufficient.
Pentesty's assessment is that a useful outcome connects the request, decision and behavior observed on the computer actually used. A security warning or click rate alone does not describe that path. Document limitations when the device is outside company management and define escalation for a real suspicion, preserving records without executing the received document again as a way to investigate it.
Frequently asked questions
Does the news confirm 80,000 computers infected in 2026?
No. DOJ attributes that number to the indictment about distribution between 2016 and 2017. The 2026 announcement concerns the proceeding and does not individually confirm that infection total.
Does a familiar platform account make its attachment trustworthy?
The channel provides context for the request but does not approve executable content. Check necessity, origin and the authorized procedure before accepting a change in the work.
Does macro blocking behave identically across Office products?
The cited guidance concerns Windows and depends on documented conditions. Identify the product, version and effective policy rather than extending the same outcome to every device.
How can this be tested without a malicious document?
Use your own spreadsheet and synthetic content, with expected outcomes and defined limits. Check blocking, exception escalation and legitimate task completion without using files from the campaign.
Sources and references
- DOJ: freelance platform indictment announcement, September 1, 2026
- Microsoft Learn: internet macros and Office on Windows scope
Original Pentesty analysis, published October 16, 2026. The proposed scenarios are editorial guidance, with scope and validation to be defined for each environment.