[Utilizer]

If you read the article, they are not FROM Dropbox but TO Dropbox. The article is about how MS Office macros are being used to install a variant of the Dyre banking malware.

[tacticalogic]

If you read the article, they are not FROM Dropbox but TO Dropbox.

I interpreted this:

The spam messages link to Dropbox sites that contain malicious Microsoft Office macros

to mean that the macros are held at the Dropbox site, and the victims are downloading them from there.