# Excel.XLL Add-Ins Cause 600% Rise in Phishing Attacks: Stay Safe Source: https://keepnetlabs.com/blog/excel-xll-add-ins-cause-600-rise-in-phishing-attacks-stay-safe Published: 2024-11-25 Updated: 2026-10-09 Author: Ozan Ucar, Founder and CEO of Keepnet Category: Cyber Security Awareness > Phishing attacks using Excel .XLL add-ins have surged by 600%. Learn what this means for your business and simple steps to protect against these threats. Cybercriminals are using **Excel .XLL add-ins** in phishing campaigns more than ever before. In fact, **the use of malicious Excel .XLL files has jumped by an incredible 588**% in a short time, showing how attackers are finding new ways to bypass security defenses. According to **IBM's 2024 X-Force Threat Intelligence Index, nearly 85% of attacks on key industries start with methods like phishing emails**, exploiting public websites, or using stolen login details. These numbers make it clear that cyber threats are getting smarter, and businesses must improve their defenses to stay protected. In this blog, we’ll explain **what Excel .XLL add-ins are**, how attackers use them, why they’re so dangerous, and the best ways to keep your organization safe. ## What Are Excel .XLL Add-Ins? **Excel .XLL add-ins** are files designed to extend the functionality of Microsoft Excel. These dynamic link library (DLL) files allow developers to create custom tools, automate tasks, and enhance productivity. However, the same features that make **Excel.XLL files** useful for legitimate purposes also make them a powerful tool for cybercriminals. These files are easy to deploy and can run malicious code when installed, making them ideal for [phishing attacks](https://keepnetlabs.com/blog/new-phishing-attack-with-shtml-files). ***Editor's Note: This article was updated on March 12, 2026***. Video: ## How Are Excel .XLL Add-Ins Used in Phishing Attacks? Attackers typically send phishing emails with **Excel.XLL file attachments**. These emails often trick users into opening the file and installing the add-in, which then deploys malware onto their system. Malware such as **Dridex**, **IcedID**, **BazaLoader**, and **Agent Tesla** has been linked to **Excel.XLL**-based phishing campaigns. These attacks exploit the unique properties of **Excel.XLL files**, like their ability to run hidden code, which helps them bypass traditional antivirus tools and other security measures. ## Why Are Excel. XLL-Based Attacks So Effective? The unique characteristics of **Excel.XLL files** give attackers several advantages over traditional methods, making them a preferred tool for phishing campaigns. - **Advanced Functionality**: Compared to VBA macros, **Excel.XLL files** can execute more complex tasks, making them an attractive option for attackers. - **Low Awareness**: Many users are unfamiliar with **Excel.XLL files**, making them more likely to trust and open them. - **Cross-Platform Compatibility**: **Excel.XLL** add-ins work on Windows, Mac, and web browsers, giving attackers more opportunities to target their victims. These factors make **Excel.XLL-based attacks** not only effective but also difficult to detect with standard security solutions. ## Real-World Impact In 2021, cybercriminals used malicious **Excel.XLL files** to deliver the Dridex banking Trojan, targeting victims through phishing emails. Once users opened the **Excel.XLL files**, Dridex was installed on their systems, allowing attackers to steal banking credentials and sensitive information. This attack caused significant financial losses and reputational damage for several organizations, highlighting the devastating impact of **Excel.XLL-based threats**. It serves as a critical reminder for businesses to bolster their defenses against such sophisticated tactics. ## Recommendations to Protect Against Excel.XLL Phishing Attacks To combat **Excel.XLL-based phishing attacks**, organizations must adopt both technical safeguards and employee training. Let’s dive into the key steps to strengthen your defenses. ### 1. Block Excel.XLL Attachments Configure your email systems to block emails containing **Excel.XLL files**. This proactive step prevents malicious files from reaching employees, reducing the likelihood of accidental installation. It’s a crucial line of defense in stopping threats before they even enter your organization. ### 2. Restrict Add-In Permissions Within Microsoft Excel, limit the permissions for add-ins to only those from trusted and verified sources. By restricting access, you minimize the risk of malicious add-ins being executed, protecting your systems from unauthorized scripts and malware. ### 3. Disable Unverified Add-Ins Prevent the installation of unverified or custom **Excel.XLL add-ins** unless explicitly approved by your IT department. Enforcing this policy ensures that only safe and necessary add-ins are allowed, significantly lowering the risk of exploitation. ### 4. Train Employees Provide employees with comprehensive [security awareness training](https://keepnetlabs.com/products/security-awareness-training) to help them recognize phishing emails and suspicious file types, including **Excel.XLL files**. Teach staff to treat unexpected attachments with caution and adopt a “verify-before-opening” approach to avoid falling victim to attacks. ### 5. Strengthen Endpoint Security Ensure that all endpoint protection and antivirus software is regularly updated to detect and block the latest malware threats, including those delivered via **Excel.XLL files**. Modern antivirus solutions are essential for identifying hidden threats that exploit new vulnerabilities. ### 6. Use Multi-Factor Authentication (MFA) Implement MFA to secure user accounts, adding an extra layer of protection against credential theft. Even if attackers gain access to a password, MFA prevents unauthorized access to sensitive systems and data. ### 7. Simulate Phishing Attacks Test employee readiness using phishing simulations with tools like [Keepnet Phishing Simulator](https://keepnetlabs.com/products/phishing-simulator). Simulations provide hands-on training, helping employees identify and respond to phishing attempts in a controlled environment, ultimately improving their real-world resilience. ## Enhance Your Defense with Keepnet Solutions The growing threat of **Excel.XLL-based attacks**requires more than just technical solutions. It demands a well-rounded strategy that includes employee training and realistic simulations. - [**Keepnet Security Awareness Training**](https://keepnetlabs.com/products/security-awareness-training): Educate employees on recognizing phishing attempts and malicious attachments. - [**Keepnet Phishing Simulator**](https://keepnetlabs.com/products/phishing-simulator): Test your team's readiness to handle phishing emails in a controlled environment. - [**Keepnet**](https://keepnetlabs.com/)'**s secure behaviour management platform**: Benchmark your organization’s human risk score and take steps to improve it. Video: ## Frequently Asked Questions ### What is an Excel XLL add in? An XLL is a dynamic link library that extends Excel functionality. It is a legitimate developer format used to add custom tools and automation, which is precisely why it makes a useful disguise. ### How do attackers abuse XLL files? They attach one to a phishing email as a routine looking spreadsheet component. Opening it executes code with the permissions of the user, without the macro warnings people have been trained to expect. ### Why are XLL attacks effective? Because the defences and the habits both point elsewhere. Macro security has been tightened over years and users have been taught to look for macro prompts, while XLL executes through a different path that many environments never restricted. ### How can organisations block this? Block XLL attachments at the gateway, restrict add in installation to approved sources, disable unverified add ins by policy, and alert on XLL execution from user directories. ### What should employees be told? That an unexpected spreadsheet component is not a document, and that file types they have never intentionally used are worth reporting rather than opening. Phishing was the initial access route in 16% of breaches in the 2026 Data Breach Investigations Report (Verizon, 2026 Data Breach Investigations Report, 2026, p. 12). ### Is this still relevant? The specific file type changes, the pattern does not. Attackers move to whatever executable format is least restricted, so the durable defence is blocking file types the business never sends and keeping reporting fast.