Microsoft's decision to block macros originating from the Internet by default has led to threat actors resorting to disk image and archive-based attacks, the global security firm Sophos claims.