Which category of malware would typically deliver payloads by tricking users into enabling macros in documents?

• A. Network-based malware
• B. macro-based malware
• C. Divergent
• D. Sheep dipping

Answer: (B)

Macro-based malware relies on embedded macro scripts in documents and persuades the user to enable macros so the payload runs. Attackers attach or link to a document (often in phishing emails) that looks legitimate, then use social engineering to convince the user to enable content. Once enabled, the macro (typically VBA) executes and can download malware, exfiltrate data, or take control of the system. This delivery method hinges on user action to run code within a trusted-looking document, rather than exploiting a network flaw directly.

Other options don’t fit this delivery path: network-based malware spreads through network exploits rather than user-activated code in a document; divergent isn’t a standard malware category; sheep dipping describes testing or training users with phishing-like simulations rather than delivering actual payloads.