Saturday, March 15, 2025
Homecyber securityVirusTotal's Crowdsourced AI Initiative to Analyze Macros With Word & Excel Files

VirusTotal’s Crowdsourced AI Initiative to Analyze Macros With Word & Excel Files

Published on

SIEM as a Service

Follow Us on Google News

VirusTotal has announced a major change to its Crowdsourced AI project: it has added a new AI model that can examine strange macros in Microsoft Office files.

This model, created by Dr. Ran Dubin from Ariel University and the ByteDefend Cyber Lab, is meant to help the platform find and analyze possible threats in Word, Excel, and PowerPoint files.

VirusTotal’s Crowdsourced AI project uses several AI models and community contributions to improve cyber defense tactics.

Even though AI-based models aren’t perfect, they are very helpful because they work with other technologies to find and analyze new dangers.

The addition of ByteDefend’s model improves VirusTotal’s Code Insight features. These features already use up to three separate AI systems for Microsoft Office files.

Free Webinar on Live API Attack Simulation: Book Your Seat | Start protecting your APIs from hackers

Consensus on Malicious Files

In a recent case, all three AI models agreed that an XLS file being studied was malicious, though they provided different amounts of information.

This agreement shows how useful it is to use more than one AI engine to check for possible threats.

Malicious XLS file
Malicious XLS file

Another time, ByteDefend marked a DOC file as harmful, but Hispasec’s system thought it was safe.

These differences of opinion show how subjective danger analysis is and how important context is.

Even though the models come to different conclusions, they explain in detail how the macros work, which gives human researchers the information they need to make intelligent choices.

ByteDefend flags a DOC file as malicious
ByteDefend flags a DOC file as malicious

Enhanced Search Capabilities

Users can view AI report results through VT Intelligence.

The “bytedefend_ai_analysis:” modifier lets users search the AI’s output, and the “bytedefend_ai_verdict:” modifier lets users search by verdict.

ByteDefend reports where "telegram" is mentioned and the verdict is "malicious"
ByteDefend reports where “telegram” is mentioned and the verdict is “malicious”

 For instance, the query bytedefend_ai_analysis: telegram and bytedefend_ai_verdict:

malicious can be used to look for ByteDefend reports that mention “telegram” and have a malicious judgment.

The ByteDefend Cyber Lab and Dr. Ran Dubin deserve praise for their important work, which VirusTotal appreciates.

The platform plans to grow its Crowdsourced AI project by letting more people with a wide range of skills and knowledge contribute.

The goal is to create a strong defense plan that everyone can work on to deal with the constantly changing online threats.

VirusTotal wants other people in the security field to join this cause.

By adding ByteDefend’s AI model, VirusTotal keeps improving its ability to look for and analyze threats in Microsoft Office files.

This makes it even more of a star in cybersecurity innovation.

On-Demand Webinar to Secure the Top 3 SME Attack Vectors: Watch for Free

Divya
Divya
Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.

Latest articles

Hackers Exploiting Exposed Jupyter Notebooks to Deploy Cryptominers

Cado Security Labs has identified a sophisticated cryptomining campaign exploiting misconfigured Jupyter Notebooks, targeting...

AWS SNS Exploited for Data Exfiltration and Phishing Attacks

Amazon Web Services' Simple Notification Service (AWS SNS) is a versatile cloud-based pub/sub service...

Edimax Camera RCE Vulnerability Exploited to Spread Mirai Malware

A recent alert from the Akamai Security Intelligence and Response Team (SIRT) has highlighted...

Cisco Warns of Critical IOS XR Vulnerability Enabling DoS Attacks

Cisco has issued a security advisory warning of a vulnerability in its IOS XR...

Supply Chain Attack Prevention

Free Webinar - Supply Chain Attack Prevention

Recent attacks like Polyfill[.]io show how compromised third-party components become backdoors for hackers. PCI DSS 4.0’s Requirement 6.4.3 mandates stricter browser script controls, while Requirement 12.8 focuses on securing third-party providers.

Join Vivekanand Gopalan (VP of Products – Indusface) and Phani Deepak Akella (VP of Marketing – Indusface) as they break down these compliance requirements and share strategies to protect your applications from supply chain attacks.

Discussion points

Meeting PCI DSS 4.0 mandates.
Blocking malicious components and unauthorized JavaScript execution.
PIdentifying attack surfaces from third-party dependencies.
Preventing man-in-the-browser attacks with proactive monitoring.

More like this

Hackers Exploiting Exposed Jupyter Notebooks to Deploy Cryptominers

Cado Security Labs has identified a sophisticated cryptomining campaign exploiting misconfigured Jupyter Notebooks, targeting...

AWS SNS Exploited for Data Exfiltration and Phishing Attacks

Amazon Web Services' Simple Notification Service (AWS SNS) is a versatile cloud-based pub/sub service...

Edimax Camera RCE Vulnerability Exploited to Spread Mirai Malware

A recent alert from the Akamai Security Intelligence and Response Team (SIRT) has highlighted...