Macro-Blocking & How Threat Actors Are Adapting - Proofpoint
Macro-Blocking & How Threat Actors Are Adapting explains the shift from Office files to archives like RAR.
Here’s a breakdown of why that specific file type is so interesting from a security perspective: The "Macro-Archive" Strategy
Inside that archive is a Word or Excel document. When you open it, it usually shows a fake "Protected" message, urging you to click "Enable Content" to see the file.
Are threat actors turning to archives and disk images? provides a technical look at how .rar and .iso files help bypass "Mark of the Web" security tags.
Historically, hackers sent .doc or .xls files directly. Now, they use a multi-step "infection chain":
You download a .rar (like the one you mentioned) or .zip file. This is often done to hide the malicious code from email scanners that might block a direct Office attachment.