Malicious Word Macro Deploys EmPyre on Mac

2 August 2026 routine threat non-profit

A weaponized Word macro targeting macOS users checks for Little Snitch, then downloads and RC4-decrypts an EmPyre post-exploitation agent from a Russian-hosted domain.

Researchers analyzed a malicious .docm file themed around a Carnegie Endowment for International Peace article, which contained a VBA macro triggered via AutoOpen. The macro executes an embedded base64-encoded Python payload that first checks whether Little Snitch (a popular macOS firewall) is running, and exits if so. If not detected, it fetches a second-stage payload from securitychecking.org, RC4-decrypts it using a hardcoded key, and executes it in memory. The first-stage Python code was found to be lifted almost verbatim from the open-source EmPyre post-exploitation framework's stager module.

The second-stage component, though inaccessible at analysis time, is presumed to be the EmPyre agent itself, which affords persistent remote access and supports modules for webcam activation, keychain dumping, and browser history theft. EmPyre offers multiple macOS persistence mechanisms including cron jobs, dylib hijacking, launch daemons, and login hooks — the dylib hijack technique notably referencing prior research by the article's author. The C2 domain resolved to 185.22.174.37, an IP geolocated in Russia with prior associations to phishing infrastructure.

The attack chain is unsophisticated technically, relying on social engineering (macro-enabled document) rather than exploiting a vulnerability, and reuses an open-source toolkit rather than custom malware. This makes it easier to detect with standard tools (persistence monitors like BlockBlock, KnockKnock, or Dylib Hijack Scanner) but still effective if a target enables macros, illustrating that user interaction remains a durable initial-access vector for macOS-targeted intrusions.

Mentioned in this report

Malware EmPyre

Detection guidance

Python Execution with Base64 Decoding and Network Activity

ATT&CK T1059.006

Detects Python interpreter decoding base64 data and making network connections—typical first-stage loader behaviour for remote payload fetch. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Python Execution with Base64 Decoding and Network Activity
description: Detects Python processes decoding base64-encoded payloads and establishing
  network connections, consistent with staged malware delivery on macOS.
tags:
- attack.execution
- attack.t1059.006
- attack.t1566.001
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    Image|endswith: /python
    CommandLine|contains:
    - base64
    - b64decode
    - import base64
  network_activity:
    Image|endswith: /python
    DestinationPort:
    - 80
    - 443
  condition: selection and network_activity
falsepositives:
- Legitimate Python development and data processing scripts
- System administration tools using base64 for config encoding
level: medium
id: d44d7b66-c57e-5d55-8daf-74565b3d7b87
status: experimental
author: Vorant

Process Checking for Security Software Presence

ATT&CK T1518.001

Detects processes checking for running macOS security tools (Little Snitch, Kaspersky, etc.) before proceeding—evasion behaviour typical of post-exploitation frameworks. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Process Checking for Security Software Presence
description: "Detects processes scanning for running security software on macOS before\
  \ executing malicious code\u2014typical evasion pattern in EmPyre and similar agents."
tags:
- attack.defense-evasion
- attack.t1518.001
logsource:
  category: process_creation
  product: macos
detection:
  selection_pgrep:
    Image|endswith:
    - /pgrep
    - /ps
    CommandLine|contains:
    - Little Snitch
    - Kaspersky
    - CrowdStrike
    - SentinelOne
    - Sophos
  selection_lsof:
    Image|endswith: /lsof
    CommandLine|contains:
    - Little Snitch
    - SecurityAgent
  condition: 1 of selection_*
falsepositives:
- Legitimate system monitoring and endpoint management tools
- IT helpdesk scripts checking AV installation status
level: medium
id: e48282db-eb6d-5d29-93f6-e277f5f29a14
status: experimental
author: Vorant

Cron Job or LaunchDaemon Creation from Unusual Parent Process

ATT&CK T1053.003

Detects creation of cron jobs or launch daemons from Python, Office processes, or scripts—persistence mechanisms commonly deployed by EmPyre. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Cron Job or LaunchDaemon Creation from Unusual Parent Process
description: Detects suspicious creation of cron jobs or launch daemon plist files
  from interpreters or Office apps, typical EmPyre persistence.
tags:
- attack.persistence
- attack.t1053.003
- attack.t1543.004
logsource:
  category: file_event
  product: macos
detection:
  selection_cron:
    TargetFilename|contains:
    - /var/spool/cron/
    - /etc/cron.d/
    ProcessImage|endswith:
    - /python
    - /python3
    - /bash
    - /sh
  selection_launchd:
    TargetFilename|contains: /Library/LaunchDaemons/
    TargetFilename|endswith: .plist
    ProcessImage|endswith:
    - /python
    - /python3
    - /bash
    - /sh
  filter_system:
    ProcessImage|contains:
    - /usr/libexec/
    - /Library/Application Support/
  condition: (1 of selection_*) and not filter_system
falsepositives:
- System automation and IT deployment tools installing legitimate cron/daemon configs
- Development environments where scripts legitimately manage cron jobs
level: high
id: 7bdb2c5d-7f80-567d-adbb-3b96854727f5
status: experimental
author: Vorant

1 more detection artefacts for this report (IOC-atomic rules, Splunk/KQL/Elastic conversions, YARA, Suricata) are available to subscribers.

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://objective-see.org/blog/blog_0x17.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free