Attackers are exploiting a new zero-day vulnerability in Microsoft Excel, researchers said.