Malicious Word Macro Deploys EmPyre on Mac

A weaponized Word macro targeting macOS users checks for Little Snitch, then downloads and RC4-decrypts an EmPyre post-exploitation agent from a Russian-hosted domain.

Researchers analyzed a malicious .docm file themed around a Carnegie Endowment for International Peace article, which contained a VBA macro triggered via AutoOpen. The macro executes an embedded base64-encoded Python payload that first checks whether Little Snitch (a popular macOS firewall) is running, and exits if so. If not detected, it fetches a second-stage payload from securitychecking.org, RC4-decrypts it using a hardcoded key, and executes it in memory. The first-stage Python code was found to be lifted almost verbatim from the open-source EmPyre post-exploitation framework's stager module.

The second-stage component, though inaccessible at analysis time, is presumed to be the EmPyre agent itself, which affords persistent remote access and supports modules for webcam activation, keychain dumping, and browser history theft. EmPyre offers multiple macOS persistence mechanisms including cron jobs, dylib hijacking, launch daemons, and login hooks — the dylib hijack technique notably referencing prior research by the article's author. The C2 domain resolved to 185.22.174.37, an IP geolocated in Russia with prior associations to phishing infrastructure.

The attack chain is unsophisticated technically, relying on social engineering (macro-enabled document) rather than exploiting a vulnerability, and reuses an open-source toolkit rather than custom malware. This makes it easier to detect with standard tools (persistence monitors like BlockBlock, KnockKnock, or Dylib Hijack Scanner) but still effective if a target enables macros, illustrating that user interaction remains a durable initial-access vector for macOS-targeted intrusions.

Source reporting: https://objective-see.org/blog/blog_0x17.html