Microsoft has moved swiftly to patch a major security flaw in all current versions of Word, used by millions of Australians.
The bug allows an exploit, known as the Dridex banking trojan, to gain access to a user's computer.
More National News Videos
- Video duration
- 02:01
Is your phone secure?
Is your phone secure?
In the age of phishing and hacking, here are three steps to help you become a cybersecurity expert.
Up Next
Manus detainee videos during alleged gunfight
- Video duration
- 02:38
- Video duration
- 02:38
Manus detainee videos during alleged ...
Manus detainee videos during alleged gunfight
A detainee has told of his fears as a gunfire rings out at the Manus Island detention centre on Friday evening.
Up Next
Audio: alleged Manus Island shooting
- Video duration
- 00:15
- Video duration
- 00:15
Audio: alleged Manus Island shooting
Audio: alleged Manus Island shooting
Several detainees reported sustained gunfire from outside the centre after violence erupted when a local tried to shutdown a soccer game involving detainees in the Navy base that surrounds the compound.
Up Next
Boy shot in the head at Glenfield home dies
- Video duration
- 00:32
- Video duration
- 00:32
Boy shot in the head at Glenfield home ...
Boy shot in the head at Glenfield home dies
A 15-year-old boy who was shot in the head 'execution-style' as he lay in bed has died in hospital. Vision: Seven News
Up Next
Insurance company was 'filming my children'
- Video duration
- 02:21
- Video duration
- 02:21
Insurance company was 'filming my ...
Insurance company was 'filming my children'
Former police officer Adam Watts details the lengths his insurance company went to deny him his workers compensation after being medically discharged from the force.
Up Next
Bays Precinct industries warn NSW government
- Video duration
- 03:16
- Video duration
- 03:16
Bays Precinct industries warn NSW ...
Bays Precinct industries warn NSW government
September 2016: Key maritime industries are concerned for the future vital ports and marine infrastructure on prime harbourside land around the inner city Bays Precinct.
Up Next
Teenage parents reunited with family
- Video duration
- 00:21
- Video duration
- 00:21
Teenage parents reunited with family
Teenage parents reunited with family
The young couple smuggled their 3-day-old baby from Nepean Hospital on Thursday, sparking a wide-scale search. Vision: Sevens News.
Up Next
Sydney teenager shot in head
- Video duration
- 00:30
- Video duration
- 00:30
Sydney teenager shot in head
Sydney teenager shot in head
A gunman is on the run after shooting a 15-year-old boy in the head at his home in Glenfield on Friday morning. Vision: Seven News.
Is your phone secure?
In the age of phishing and hacking, here are three steps to help you become a cybersecurity expert.
Once access is gained, a hacker can then steal the users' personal banking details and passwords.
The bug was detected late last week by multiple sources, including cyber security companies McAfee and FireEye.
Related Content
Victims are affected by opening compromised Word documents sent to them via email with attachments that are loaded with the bug, security firm Proofpoint said in a blog post on Monday.
The subject line in all cases reportedly reads "Scan Data" and the attachments are named Scan_xxxxxx.doc", where xxxxxx is a random number.
Scanned documents are sent via emails that commonly carry similar subject lines.
The targets were primarily in Australia and across numerous organisations, Proofpoint said.
Dridex is a so called "zero-day vulnerability", which means that it was sent out with zero notice for Microsoft to create and implement a patch to thwart it.
While most malware requires human intervention to activate it in a system, the Microsoft zero-day can run by simply opening the corrupted Word document.
Proofpoint said its testing revealed computers infected with the malware to be "fully exploited" (exposed).
It recommended that "because of the widespread effectiveness and rapid weaponisation of this exploit, it is critical that users and organisations apply the patch as soon as possible".
"One of the reasons Dridex actors targeted millions of Australian recipients [was] because they wanted to take advantage of the small window before it was patched.
"Sending it to Australian organisations early on Tuesday morning Australian time/late Tuesday US time provided a longer window of possible exposure," Bryan Burns of Proofpoint said.
A Microsoft spokesperson said: "[The vulnerability] was addressed in the April security update released on April 11, 2017.
"Customers who applied the update, or have automatic updates enabled, are already protected."
A similar exploit allowed hackers to steal more than £20 million ($33 million) from British bank accounts in 2015, the BBC reported.
Correction: An earlier version of this story incorrectly referred to the Dridex banking trojan as a bug rather than an exploit that takes advantage of a bug or vulnerability.