For all intents and purposes, macros are enabled by default. Yes, there's a simple "Click to enable" prompt. Everyone looks at it as "the button you need to click to load the document". People do it without even realising because it's so benign looking.

Look at the Word document in this campaign, which is just one example of many:

https://www.bleepingcomputer.com/news/security/new-trickbot-...

I can only relate to the experience of sending out phishing tests that rely on users clicking "enable". Either the business has it disabled by a policy, or the success rate will be close to 100%.

I'm reading it as it being disabled beyond a confirmation modal. You probably have to change some file attribute to re-enable it, perhaps.

Edit: Yep, from the linked article inside the article -

"Once a user opens an attachment or downloads from the internet an untrusted Office file containing macros, a message bar displays a Security Risk that the file contains Visual Basic for Applications (VBA) macros obtained from the internet with a Learn More button.

The Learn More button goes to an article for end users and information workers that contains information about the security risk of bad actors using macros, safe practices to prevent phishing & malware, and instructions on how to enable these macros by saving the file and removing the Mark of the Web (MOTW)."

From the article:

> Attackers have already had to adapt to tricking users into affirmatively running macros, but the new moratorium means targets would have to carry out a much more involved process to be infected—making it much less likely that attackers will be able to successfully guide them through it.

I didn't see a description of the new process, but it sounds like they beefed it up some.

I'm perplexed too! How does this article reconcile with the existing disabled by default practice?

> Security Warning Macros Have Been Disabled [enable content]

At best, the headline is still misleading. Macros are already disabled. Clicking more "are you sure?" prompts is different and dubious