You'd be surprised how successful something like this can be - especially for a typical user who may not have any security controls in place. Also, I would argue that if you are able to convince a user to execute code you have provided, a malicious exploit is probably not even necessary - (i.e. "Microsoft Tech Support calls" that obtain remote access to systems utilizing legitimate tools).
In a corporate environment, there would be a variety of security measures that should help to prevent (stop it from happening) and control (limit the successfulness) of such an attack. Most companies take a layered security approach with multiple measures in place.
Walking through how such an attack would take place, here are some of the controls that might be implemented for an attack like this:
Provide malicious file to user via email or other means
- Email filtering (Antispam, AV, whitelisting), Email policies (Attachment restrictions such as size or file type)
- User saves file and launches it
- User awareness training, group policy restrictions (prevent files can be launched from), application whitelisting (prevents unknown files from running), Endpoint AV (scans/deletes/blocks known malicious files).
- File launches and establishes connection back to attacker (perhaps via an exploit or via legitimate software
- Endpoint and/or network (egress) filtering or proxy (block unknown/untrusted connections), system patches (block known exploits)
- Attacker gains control of system, exfiltrates data, maintains access, and spreads laterally
- Restricted user permissions (i.e. non-admin), monitoring tools (to record forensic activity for later review)
I'm sure there are more but this was briefly pulled from the top of my head - but you can always take an attack, walk through the appropriate steps, then think of potential mitigations for those steps - and of course you can then rinse, repeat with more attacks against those mitigations.