This was just to prevent this specific attack - kind of a stopgap until the AV detects it properly.<p>IIRC last time I checked the Word doc on virustotal it was picked up 22&#x2F;55.<p>Fortunately at least AV did pick up the payload when a user let the macro run...<p>Edit, ran it by virustotal again and got 28&#x2F;55