Microsoft's decision to disable macros by default last year has forced hacking crews to find new, and sometimes old, ways to get a foothold.