Researchers detail a vulnerability in Excel's Power Query that can be abused to link to a webpage that contains malware; the exploit is in all versions of Excel
YOU PROBABLY THINK of Microsoft's classic spreadsheet program Excel as mostly boring. Sure, it can wrangle data, but it's not exactly Apex Legends.
Context & Ripple Effects
Excel is the most widely deployed attack surface in office software — related coverage counts 500M paying users even as Google competes for the same seats — so a flaw present in every version of the product is effectively universal exposure. The disclosure also fits a pattern: two years earlier, a Word exploit that bypassed Windows safeguards was mass-mailed to push Dridex bank-fraud malware, showing Microsoft's document formats doubling as malware delivery vehicles.
What makes this one distinct is the mechanism: Power Query, a data-import feature, becomes the lure by pointing a spreadsheet at a malware-hosting webpage — turning a routine analytics workflow into an infection path.
First-order effects
- Microsoft faces a patching burden across its entire installed base of Excel versions, since no release line is exempt from the Power Query flaw.
- Users who open unfamiliar workbooks are exposed to a new class of lure: a legitimate-looking data import that silently links out to attacker-controlled pages.
Second-order effects
- Attackers demonstrably kept investing in spreadsheet lures — a year later Microsoft disclosed Chimborazo distributing a malicious Excel document behind a CAPTCHA gate to defeat automated scanners, exactly the kind of evasion this class of flaw invites.
- Email security and sandboxing vendors have to inspect not just macros but embedded external connections inside workbook files, raising the cost of filtering Office attachments.
Third-order effects
- If the pattern holds, Office documents remain a durable malware channel independent of any single feature, forcing Microsoft to treat data-import and linking features as security surfaces rather than productivity conveniences.
- Disclosure dynamics around such flaws get contentious: as the later GitHub takedown of an Exchange proof-of-concept showed, platforms hosting exploit research are pulled between researcher transparency and abuse prevention.
The trend: The Office suite keeps resurfacing as a preferred malware delivery vector, with each new feature — macros, then Power Query — becoming the next infection route Microsoft has to harden.