MacSploit: Office Macro Escapes macOS Sandbox

2 August 2026 routine threat

A researcher demonstrates using a flawed sandbox regex exception in Microsoft Office for Mac to drop a LaunchAgent and escape the app sandbox, enabling unrestricted Empire C2 access.

This is a red-team research writeup (via MDSec, republished by Objective-See) detailing how Microsoft Office for Mac's sandbox entitlements can be abused to gain unrestricted code execution. The author found that Office applications (Word, Excel) are granted a temporary-exception sandbox rule permitting file read/write anywhere on disk provided the filename matches a regex intended for temp files (e.g. ~$document.docx). Because the regex is overly permissive, an attacker running VBA macro code inside the sandboxed Office process can write arbitrary files matching that pattern anywhere on the filesystem, including into ~/Library/LaunchAgents.

By dropping a malicious LaunchAgent plist that matches the temp-file regex, an attacker can have launchd execute an unsandboxed payload (e.g., a Python-based Empire agent) the next time the user logs in — or immediately by forcibly logging the user out via launchctl bootout. This effectively breaks out of the Office application sandbox that otherwise restricts network and system access for a phishing-delivered VBA macro payload generated via the Empire C2 framework's macOS/Office stager.

The technique was confirmed to work across all Microsoft Office 2016 for Mac applications supporting macros, since they share the same sandbox entitlement/exception. This is disclosed as offensive-security research intended for red-team engagements rather than observed in-the-wild attacker activity, but it demonstrates a viable initial-access-to-sandbox-escape chain relevant to phishing campaigns targeting macOS/Office users in enterprise environments.

Mentioned in this report

Malware Empire

Detection guidance

VBA Macro Calling LaunchCtl to Force User Logout

ATT&CK T1059.005

Detects Office VBA macro code executing launchctl bootout commands to trigger immediate user logout for sandbox-escape LaunchAgent activation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: VBA Macro Calling LaunchCtl to Force User Logout
description: Detects VBA macro code within Office applications invoking launchctl
  bootout or similar commands to force an immediate user logout. Used in conjunction
  with malicious LaunchAgent plist placement to trigger sandbox-escape payload execution.
tags:
- attack.execution
- attack.t1059.005
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    ParentImage|endswith:
    - /Microsoft Word
    - /Microsoft Excel
    Image|endswith: /launchctl
    CommandLine|contains:
    - bootout
    - gui/
  condition: selection
falsepositives:
- Legitimate admin automation invoking launchctl from Office processes (rare)
level: medium
id: b084e330-d5ce-5e82-a7a3-ac0ef30a0cba
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://objective-see.org/blog/blog_0x35.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free