A pair of recent findings show how hackers can compromise Excel users without any fancy exploits.