Criminals are exploiting a new bug in Microsoft Word according to security company Symantec.
The company posted a warning on its website that it had seen attackers using "what is possibly an undisclosed vulnerability affecting Microsoft Word."
The security vendor released few details of the attack, saying that it is still working with Microsoft to confirm its findings. "Initial analysis suggests that some Microsoft Office versions, even when fully patched, are affected by this exploit," Symantec said.
There have been a large number of bugs found in Microsoft's Office software, including Word, over the past few years. In order to exploit these flaws, attackers must typically trick the victim into opening a maliciously encoded Office document, which then allows them to install malicious software on the PC.
In this case, the malicious code is a Trojan horse program, called Backdoor.Darkmoon, which logs the victim's keystrokes in order to steal passwords.
Symantec's anti-virus software is now detecting the attack, but the security company recommends that users avoid opening unsolicited Word documents.
This is the second Microsoft attack reported this week. On Monday, Microsoft said that cycbercriminals were exploiting a bug in Access That flaw lies in the Snapshot Viewer ActiveX control, which ships with "all supported versions of Microsoft Office Access except Microsoft Access 2007," Microsoft said in a security advisory.