VBA macro writes hosts-file redirect entries

The macro opens %SystemRoot%\System32\drivers\etc\hosts for output or append and writes entries mapping a hostname to an address. The redirect is system-wide and survives reboot. Pointed at an attacker-controlled address it silently substitutes a site the user keeps visiting — the Xanpei/Sibhost family did this to Chinese e-commerce domains for affiliate fraud; pointed at 127.0.0.1 it blackholes antivirus and update domains so the infection cannot be cleaned. A document has no legitimate reason to edit the hosts file. Merely naming the path does not fire this rule: a write primitive and a parsed address/hostname entry are both required.