"... if anything, people are trained not to download Word documents. Plus, he noted, looking at the blurred example in the report, the malicious document contained an additional apparently blank page which held the concealed prompts in white text."

Yep, defence starts with people not opening Word documents 🤦‍♂️