content: This is the mechanism de jour for most malware it seems. I've went as far as to block all Macro-Enabled documents on the workstations on my network, as well as .docm and associated formats. Better safe than sorry, already seen it come in before.  I find it funny that this method of replication is nothing new, we saw it in the '90s with the LoveLetter virus. Some things never change.