Vuusale wanted to know whether phishing simulation targets actually opened an Excel file and ended up with a macro-free exfiltration trick.
A data source pointing at a local file (Data, Get Data, From File, From Text/CSV) can be set to refresh whenever the workbook opens, which drops the file content into a cell.
A =WEBSERVICE(CONCAT(...)) formula appends that cell to an attacker URL, and since part of the URL is dynamic, Excel fires the GET request on open without anyone pressing Ctrl+Alt+F9.
Put the data into a subdomain of a domain you control instead and it leaves through DNS lookups, within the subdomain length limit.
The author warns that some antivirus engines may flag the file read, while a workbook with only an “import from web” data source goes undetected even by XDR.
WEBSERVICE turned up while the author was exploring Excel functions in an Economy class, so that lecture paid off for somebody.
