Malicious email attachments with macros are one of the most common ways hackers get in through the door. Malicious Office documents, or maldocs, can execute code via macros if they are given explicit user permission. The most successful phishing campaigns do three things: Set the stage with a threat with a pretense, strike fear and strike fear. The adversary also may implant code on a staged website or HTML file, forcing the users browser to download a file or leave behind cookies that can be used for later actions.”]
Source: https://threatpost.com/maldocs-malicious-office-documents-human-vulnerability/176916/