Microsoft Office documents disguised as a payment-related information contain macros that could unleash the Dyre malware and other threats, a security researcher has warned.

Writing on the InfoSec Community Forums, Brad Duncan provides an in-depth look at how the Dyre malware, a banking Trojan, is being distributed by Bartalex, a macro-based form of malicious software that was discovered earlier this year. Attached in spam messages, the Microsoft documents purport to come from a payroll processing specialist and attempt to trick victims into opening them to find out about an Automated Clearing House Payment that has been rejected.

According to Threatpost, cybercriminals have used Bartelex as a vehicle for Dyre malware before, most recently via Dropbox links that prompted the online storage service to remove certain users from sharing links. This latest incident, however, also includes the Pony, a Trojan best known for stealing passwords and even bitcoins.

CISOs may be alarmed to learn that Dyre malware attacks are becoming more stealthy and sophisticated. Computing recently reported that major financial institutions, including the Royal Bank of Scotland and Lloyd’s Bank, were targeted in a campaign that used more than 19,000 spam messages containing the Trojan in a 72-hour period. The spam referred to phony follow-up messages from a tax consultant that tried to trick victims into downloading a form.

While cybercriminals have used Zeus and other Trojans to steal bank account information and similar credentials for some time, experts say the Dyre malware has proven particularly difficult to ward off. In early April, Security Intelligence profiled a variant known as Dyre Wolf that was using distributed denial-of-service (DDoS), man-in-the-middle (MitM) attacks and other approaches to infect machines. Social engineering has also been a staple of recent attempts to penetrate the financial sector.

The Register pointed out that while it is only about a year old, Dyre malware has been used to attack both enterprises and their customers. This is possible not only because it was well-designed, but because human nature can be a weak link no matter where you go.

In other words, don’t give in to temptation when an unexpected message or document arrives and open it right away. That’s what cybercriminals are counting on.