Microsoft eventually updated the Office apps to not run ActiveX content automatically, but some malicious files can successfully trick people into clicking the ‘Enable Content’ button.