New Excel zero-day flaw used in attacks