MacSploit: Office Macro Escapes macOS Sandbox

PublishedThe source gives no date · added 2 August 2026 Vorant ratingroutine threat

Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

A researcher demonstrates using a flawed sandbox regex exception in Microsoft Office for Mac to drop a LaunchAgent and escape the app sandbox, enabling unrestricted Empire C2 access.

Sourceobjective-see.org — open the original

What to check

Applies to: Whether this concerns you is not assessed; the names the report mentions are listed below.
Date: The source gives no publication date; the date shown is the day Vorant added the brief.

This is a red-team research writeup (via MDSec, republished by Objective-See) detailing how Microsoft Office for Mac's sandbox entitlements can be abused to gain unrestricted code execution. The author found that Office applications (Word, Excel) are granted a temporary-exception sandbox rule permitting file read/write anywhere on disk provided the filename matches a regex intended for temp files (e.g. ~$document.docx). Because the regex is overly permissive, an attacker running VBA macro code inside the sandboxed Office process can write arbitrary files matching that pattern anywhere on the filesystem, including into ~/Library/LaunchAgents.

By dropping a malicious LaunchAgent plist that matches the temp-file regex, an attacker can have launchd execute an unsandboxed payload (e.g., a Python-based Empire agent) the next time the user logs in — or immediately by forcibly logging the user out via launchctl bootout. This effectively breaks out of the Office application sandbox that otherwise restricts network and system access for a phishing-delivered VBA macro payload generated via the Empire C2 framework's macOS/Office stager.

The technique was confirmed to work across all Microsoft Office 2016 for Mac applications supporting macros, since they share the same sandbox entitlement/exception. This is disclosed as offensive-security research intended for red-team engagements rather than observed in-the-wild attacker activity, but it demonstrates a viable initial-access-to-sandbox-escape chain relevant to phishing campaigns targeting macOS/Office users in enterprise environments.

Mentioned in this report

Malware Empire

Detection guidance

VBA Macro Calling LaunchCtl to Force User Logout

ATT&CK T1059.005 · status experimental · needs macos process_creation logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general.

Detects Office VBA macro code executing launchctl bootout commands to trigger immediate user logout for sandbox-escape LaunchAgent activation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: VBA Macro Calling LaunchCtl to Force User Logout
description: Detects VBA macro code within Office applications invoking launchctl
  bootout or similar commands to force an immediate user logout. Used in conjunction
  with malicious LaunchAgent plist placement to trigger sandbox-escape payload execution.
tags:
- attack.execution
- attack.t1059.005
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    ParentImage|endswith:
    - /Microsoft Word
    - /Microsoft Excel
    Image|endswith: /launchctl
    CommandLine|contains:
    - bootout
    - gui/
  condition: selection
falsepositives:
- Legitimate admin automation invoking launchctl from Office processes (rare)
level: medium
id: b084e330-d5ce-5e82-a7a3-ac0ef30a0cba
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://objective-see.org/blog/blog_0x35.html

Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the malware it names. The paid plans add the security research and news reporting the free tier leaves out.

It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.

Create a free account What it costs