Attackers trick victims into clicking malicious links that execute macros automatically to inject a malicious payload into the process memory.

• A. Network-based malware
• B. macro-based malware
• C. Disk-based malware
• D. USB-based malware

Answer: (B)

Macro-based malware is being tested here. Attackers rely on documents that contain malicious macros; when a victim clicks a link, the macro runs, often automatically, and executes code that injects a payload directly into the running process’s memory. This memory-resident approach means the malicious activity happens in the target’s RAM rather than requiring the payload to be stored on disk, making it tougher to detect with simple file-based scans. The scenario hinges on social engineering to trigger macro execution in memory, which is the hallmark of macro-based malware.

This differs from network-based malware, which relies on remote delivery over a network; disk-based malware, which leaves a file on storage to execute later; and USB-based malware, which requires a physical USB device to introduce the payload.