How to use Word and Excel honeytokens

Create a Word or Excel token, download the file from the token page, and put it where a real document of that type would live. The tripwire is an HTTP fetch, not a macro. Nobody has to click Enable macros.

Word (.docx): Microsoft Word and LibreOffice Writer usually load a tiny linked image when they open the file. That request is the alert. If Word shows Protected View, the fetch may wait until Enable editing.

Excel (.xlsx): same idea in Microsoft Excel or LibreOffice Calc. Apple Numbers and Google Sheets usually skip that linked image. Do not use those as your test.

These stay silent on open: Apple Pages, Google Docs, TextEdit, Quick Look, Numbers, Google Sheets, and most preview panes. That is the app refusing the graphic, not a dead token. Details: Why Pages and Google Docs do not trip a Word honeytoken.

Mac and browser coverage: on a Word token, also click Download HTML. Plant salary-review.html next to salary-review.docx (use your real filename). Opening the HTML in Safari or Chrome loads a tracking pixel. That is the reliable test when people live in Pages or a browser.

A fresh Word download may start with a line that says Latest version and then a web address. That address is the same beacon. Clicking it can alert. Opening the .docx in Pages or Google Docs still will not.

Word placement that looks normal: HR drafts, policy templates, vendor NDAs, a salary review folder on a file share or Teams library. Match how your company already names files. A file called decoy.docx gets deleted. A file called 2026-comp-cycle-draft.docx gets opened.

Excel placement that looks normal: quarter close, headcount, vendor pricing, inventory. Finance and ops shares get browsed by insiders and by anyone who stole a laptop or a synced OneDrive folder.

Email: attach the Office file to a mailbox you watch, or to a list that should never receive that attachment from outside. Outlook using Word or Excel as the editor can fire. Gmail or Drive preview of the attachment often will not. If the bait is "click to view the report", use an HTTP or QR token instead of hoping the attachment preview fetches.

USB and bait laptops: leave the file on removable media or a decoy machine. macOS Quick Look will not fire. Opening in Word or Excel can.

A simple mix that covers most orgs: Word or Excel on Windows office shares, HTML from the same Word token beside the .docx for Mac and browsers, QR or HTTP if the lure is a link in mail. PDF is separate and only auto-opens in Adobe. See Why PDF honeytokens often do not fire if that is the question.

How to test: download a new file from the token page. Open the .docx in Word or Writer, or the .xlsx in Excel or Calc. Check Trigger History. If you planted HTML, open that in a browser too. If Pages or Google Docs stayed quiet, that is expected.

Do not paste live beacon URLs into a public thread. Say "Word, opened in Word, alert showed" or "opened in Pages, silent."