Excel for Mac SYLK files auto-run XLM macros

2 August 2026 routine vulnerability

SYLK (.slk) files auto-execute XLM macros in fully-patched Excel 2016/2019 for macOS even with the strictest macro setting enabled, enabling silent code execution.

Researchers at Objective-See revisited a technique originally disclosed by Pieter Ceelen and Stan Hegt (Outflank) at DerbyCon 2018, which showed that legacy SYLK (.slk) files opened by Microsoft Excel for Mac auto-execute embedded XLM macros without any prompt, even when the 'Disable all macros without notification' setting is enabled. While the original finding was dismissed by Microsoft as affecting only unsupported Office 2011, Objective-See demonstrates the flaw persists in fully-patched Excel 2016 and 2019 on macOS, corroborated by CERT/CC vulnerability note VU#125336. The team built a proof-of-concept SYLK file that leverages the XLM CALL function to invoke libc.dylib's system() function and launch Calculator.app, confirming that macOS registers Excel as the default handler for .slk files via its Info.plist CFBundleDocumentTypes declaration, causing automatic, silent execution upon double-click — even for files downloaded from the internet.

Despite achieving proof-of-concept code execution, the researchers note that real-world exploitation is significantly constrained by macOS security architecture. Excel operates within Apple's app sandbox (com.apple.security.app-sandbox), restricting the macro's spawned processes from accessing user files or installing persistent malware. On macOS Catalina, additional defenses — enforced quarantine checks regardless of execution method, and mandatory code notarization for compiled binaries — further reduce the practical impact, since quarantined or non-notarized code will be blocked even if sandbox escape is achieved.

The post is primarily an analytical deep-dive rather than a report of active exploitation; no in-the-wild campaign or threat actor is described. The authors recommend administrators set Office macro settings to 'Disable all macros with notification' and, per CERT guidance, block SYLK (.slk) file attachments at email and web gateways to mitigate the underlying vulnerability class.

Detection guidance

Excel for Mac Opening SYLK Files

ATT&CK T1204.002

Microsoft Excel on macOS opening .slk (SYLK) files that may trigger silent XLM macro execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Excel for Mac Opening SYLK Files
description: Detects Microsoft Excel on macOS opening .slk (SYLK) files, which can
  silently execute embedded XLM macros regardless of macro security settings.
tags:
- attack.execution
- attack.t1204.002
- attack.t1059
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    Image|endswith: /Excel
    CommandLine|contains: .slk
  condition: selection
falsepositives:
- Legitimate users opening SYLK files for data analysis or import
- IT administrators testing SYLK file compatibility
level: medium
id: 573085bd-e717-54da-977b-a7293a6f572d
status: experimental
author: Vorant

XLM Macro Execution via SYLK File in Excel for Mac

ATT&CK T1059

Excel for Mac executing XLM macros embedded in SYLK files, potentially calling system functions via libc. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: XLM Macro Execution via SYLK File in Excel for Mac
description: Detects Excel on macOS processing SYLK files that trigger XLM macro execution,
  including patterns of system function invocation via libc.dylib.
tags:
- attack.execution
- attack.t1059
- attack.t1027
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    Image|endswith: /Excel
    CommandLine|contains: .slk
  suspicious_child:
    ParentImage|endswith: /Excel
    Image|endswith:
    - /Calculator
    - /bash
    - /sh
    - /zsh
  condition: selection and suspicious_child
falsepositives:
- Excel launching helper applications or system utilities as part of legitimate feature
  functionality
level: high
id: 044ca31a-15d3-5589-940b-7aa91d8771d5
status: experimental
author: Vorant

SYLK File Downloaded from Internet Opened by Excel for Mac

ATT&CK T1204.002

Excel for Mac opening a SYLK file carrying the macOS quarantine extended attribute, indicating download from internet. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: SYLK File Downloaded from Internet Opened by Excel for Mac
description: Detects Excel on macOS opening .slk files that carry the com.apple.quarantine
  extended attribute, indicating download from untrusted source.
tags:
- attack.execution
- attack.t1204.002
- attack.t1027
logsource:
  category: file_event
  product: macos
detection:
  selection:
    Image|endswith: /Excel
    FileName|endswith: .slk
    Xattr|contains: com.apple.quarantine
  condition: selection
falsepositives:
- Users downloading legitimate SYLK templates or data exports from trusted sources
- IT staff testing file handling with downloaded SYLK samples
level: medium
id: f2cec5a8-de8b-516a-a4a1-4d28b19a3597
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://objective-see.org/blog/blog_0x50.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free