# MacSploit: Office Macro Escapes macOS Sandbox

Published: 2026-08-02 · Severity: low
Canonical: https://vorant.io/reports/496a3c8f-92a2-548f-bab6-1eee603ed68f/macsploit-office-macro-escapes-macos-sandbox

> A researcher demonstrates using a flawed sandbox regex exception in Microsoft Office for Mac to drop a LaunchAgent and escape the app sandbox, enabling unrestricted Empire C2 access.

This is a red-team research writeup (via MDSec, republished by Objective-See) detailing how Microsoft Office for Mac's sandbox entitlements can be abused to gain unrestricted code execution. The author found that Office applications (Word, Excel) are granted a temporary-exception sandbox rule permitting file read/write anywhere on disk provided the filename matches a regex intended for temp files (e.g. ~$document.docx). Because the regex is overly permissive, an attacker running VBA macro code inside the sandboxed Office process can write arbitrary files matching that pattern anywhere on the filesystem, including into ~/Library/LaunchAgents.

By dropping a malicious LaunchAgent plist that matches the temp-file regex, an attacker can have launchd execute an unsandboxed payload (e.g., a Python-based Empire agent) the next time the user logs in — or immediately by forcibly logging the user out via launchctl bootout. This effectively breaks out of the Office application sandbox that otherwise restricts network and system access for a phishing-delivered VBA macro payload generated via the Empire C2 framework's macOS/Office stager.

The technique was confirmed to work across all Microsoft Office 2016 for Mac applications supporting macros, since they share the same sandbox entitlement/exception. This is disclosed as offensive-security research intended for red-team engagements rather than observed in-the-wild attacker activity, but it demonstrates a viable initial-access-to-sandbox-escape chain relevant to phishing campaigns targeting macOS/Office users in enterprise environments.

## Mentioned in this report

- Malware: Empire

Source reporting: https://objective-see.org/blog/blog_0x35.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/496a3c8f-92a2-548f-bab6-1eee603ed68f/macsploit-office-macro-escapes-macos-sandbox.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup