XLS files sent via emails appear password protected but aren’t, opening automatically to install malware from compromised macros, according to researchers.
Source: Threadpost