Phishing emails with a word document attachment typically will have macros that can be ran for malicious purposes. Macros are scripts that can run whatever you want and however many times you want it to run, it's generally used for automating frequently used tasks.
Since macros can practically do whatever you want, they can be used for malicious purposes such as infecting other files, or downloading/installing other malicious software.
Macros would normally run as soon as the document is opened but now macros are disabled in Office apps by default so you would need to manually enable marcos on the file for them to run.