You download a .rar (like the one you mentioned) or .zip file. This is often done to hide the malicious code from email scanners that might block a direct Office attachment.
Macro-Blocking & How Threat Actors Are Adapting - Proofpoint Office Macro Downloader.rar
Once enabled, the macro (VBA code) runs in the background. It doesn't usually be the virus itself; it's a "downloader" that reaches out to a remote server to pull down the actual malware—like ransomware or a credential stealer. Why This is Trending Again You download a
Inside that archive is a Word or Excel document. When you open it, it usually shows a fake "Protected" message, urging you to click "Enable Content" to see the file. Office Macro Downloader.rar