[technion]

The "difference" is only an advantage to attackers, in that executables are typically blocked as email attachments and Office macros are not.

Here's a ransomware incident report from someone opening an Excel document with macros enabled:

https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-no...