Could someone create a piece of malware on Microsoft Word using VBA and a macro?

Answer 1

Yes, this is why whenever you receive a spreadsheet with an external connection it will prompt you asking to "enable content". The best practice is to ignore this prompt, or X out on the right-hand side rather than enabling it.

Files such as .xlsm or .xlsb can contain macros which can contain malware or access a file somewhere that does.

Answer 2

Correct. With only a few lines of standard code written in Excel VBA, and without having to be a hacker, you can access a computer's entire directory, copy, move and delete files, and open other applications. In the wrong hands this can be very damaging.

Managing files and folders in Excel is a standard practice for many managers who want to automate certain routines. Use File>Info>Check for Issues (used to be called Inspect Document) when downloading any external workbook (Mark's recommendation is perfect); remove macros by saving file as a standard xlsx or by going in to VBA editor and check for any suspicious code.

Hope this helps!