Researchers at Cymulate security firm devised a new stealthy technique to deliver malware leveraging videos embedded into weaponized Microsoft Office documents. The technique could be used to execute JavaScript code when a user clicks on a YouTube video thumbnail embedded in a weaponized Office document. Experts pointed out that no message is displayed by Microsoft Office to request the victims consent. Attackers could use this for malicious purposes such as phishing, as the document will show the embedded online video with a link to YouTube, while disguising a hidden HTML/javascript code that will be running in the background.”]
Source: https://securityaffairs.co/wordpress/77442/hacking/weaponized-microsoft-office-documents.html