Malicious Word Macro Deploys EmPyre on Mac

PublishedThe source gives no date · added 2 August 2026 Vorant ratingroutine threat Non-profit / NGO

Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

A weaponized Word macro targeting macOS users checks for Little Snitch, then downloads and RC4-decrypts an EmPyre post-exploitation agent from a Russian-hosted domain.

Sourceobjective-see.org — open the original

What to check

Applies to: Whether this concerns you is not assessed; the names the report mentions are listed below.
Date: The source gives no publication date; the date shown is the day Vorant added the brief.

Researchers analyzed a malicious .docm file themed around a Carnegie Endowment for International Peace article, which contained a VBA macro triggered via AutoOpen. The macro executes an embedded base64-encoded Python payload that first checks whether Little Snitch (a popular macOS firewall) is running, and exits if so. If not detected, it fetches a second-stage payload from securitychecking.org, RC4-decrypts it using a hardcoded key, and executes it in memory. The first-stage Python code was found to be lifted almost verbatim from the open-source EmPyre post-exploitation framework's stager module.

The second-stage component, though inaccessible at analysis time, is presumed to be the EmPyre agent itself, which affords persistent remote access and supports modules for webcam activation, keychain dumping, and browser history theft. EmPyre offers multiple macOS persistence mechanisms including cron jobs, dylib hijacking, launch daemons, and login hooks — the dylib hijack technique notably referencing prior research by the article's author. The C2 domain resolved to 185.22.174.37, an IP geolocated in Russia with prior associations to phishing infrastructure.

The attack chain is unsophisticated technically, relying on social engineering (macro-enabled document) rather than exploiting a vulnerability, and reuses an open-source toolkit rather than custom malware. This makes it easier to detect with standard tools (persistence monitors like BlockBlock, KnockKnock, or Dylib Hijack Scanner) but still effective if a target enables macros, illustrating that user interaction remains a durable initial-access vector for macOS-targeted intrusions.

Mentioned in this report

Malware EmPyre

Detection guidance

Process Checking for Security Software Presence

ATT&CK T1518.001 · status experimental · needs macos process_creation logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general.

Detects processes checking for running macOS security tools (Little Snitch, Kaspersky, etc.) before proceeding—evasion behaviour typical of post-exploitation frameworks. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Process Checking for Security Software Presence
description: "Detects processes scanning for running security software on macOS before\
  \ executing malicious code\u2014typical evasion pattern in EmPyre and similar agents."
tags:
- attack.t1518.001
logsource:
  category: process_creation
  product: macos
detection:
  selection_pgrep:
    Image|endswith:
    - /pgrep
    - /ps
    CommandLine|contains:
    - Little Snitch
    - Kaspersky
    - CrowdStrike
    - SentinelOne
    - Sophos
  selection_lsof:
    Image|endswith: /lsof
    CommandLine|contains:
    - Little Snitch
    - SecurityAgent
  condition: 1 of selection_*
falsepositives:
- Legitimate system monitoring and endpoint management tools
- IT helpdesk scripts checking AV installation status
level: medium
id: e48282db-eb6d-5d29-93f6-e277f5f29a14
status: experimental
author: Vorant

1 more detection for this report is in the app — an indicator rule with Sigma, Splunk SPL, Elastic, Microsoft Defender XDR KQL, and YARA. Free account, no card.

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://objective-see.org/blog/blog_0x17.html

Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the malware it names. The paid plans add the security research and news reporting the free tier leaves out.

It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.

Create a free account What it costs