A little while back we were investigating the malicious activities of the Freakyshelly targeted attack. We came across spear phishing emails that had interesting documents attached to them. They contained links to PHP scripts located on third-party web resources. When we attempted to open these files in Microsoft Word, we found that the application addressed one of the links. As a result, the attackers received information about the software installed on the computer. We decided to examine why Office followed that link, and how these links can be identified in documents.”]
Source: https://securelist.com/an-undocumented-word-feature-abused-by-attackers/81899/