Exploit Using Microsoft Excel Power Query for Remote DDE Execution Discovered
(World News Science)

Mimecast Threat Center discovered a weakness in the Microsoft Excel tool that allows embedding malicious payloads remotely. Summary (Editor`s note: The Mimecast Threat Center team would like to acknowledge the contributions of team member Doron Attias in the following research.) The Mimecast Threat Center found and developed a technique that uses a feature in Microsoft Excel called Power Query to dynamically launch a remote Dynamic Data Exchange (DDE) attack into an Excel spreadsheet and actively control the payload Power Query. Power Queryis a powerful and scalable Business Intelligence (BI) tool that lets users integrate their spreadsheets with other data sources, such as an external...