Trojan rides in on unpatched Office flaw