Zimbra by default doesn’t allow blocking attachment with embedded macros, but the underneath ClamAV component can. By enabling the OLE2BlockMacros option in clamd.conf you can cut off attachment containing macros.

The option is available since clamav 0.96.5 (year 2010), so any late Zimbra (considering their current release rate) supports that.

So in order to enable it open /opt/zimbra/conf/clamd.conf.in and add to the bottom a line with

OLE2BlockMacros yes

and then restart amavisd (as user zimbra)

zmclamdctl restart