Bitcoin lure macro doc targets macOS Office

2 August 2026 elevated threat financial-services

A malicious Word macro doc lures Bitcoin/crypto professionals, escapes Word's macOS sandbox, and drops a Meterpreter stager via Python.

A Word document named BitcoinMagazine-Quidax_InterviewQuestions_2018.docm was discovered targeting macOS Office users under the guise of a Bitcoin interview questionnaire. Analysis of the embedded VBA macro revealed it uses libc.dylib's popen function to call system(), reproducing a previously published sandbox-escape technique (from a guest blog by Adam Chester) to write a malicious LaunchAgent plist to disk, bypassing Word's macOS sandbox restrictions that normally prevent persistence.

The LaunchAgent executes a base64-encoded first-stage Python payload that repeatedly attempts to connect to a remote server at 109.202.107.20 on port 9622, retrieving a second-stage payload over the socket. Analysts decoded and executed the retrieved payload, identifying it as Metasploit's Meterpreter, giving the attacker a feature-rich in-memory implant capable of arbitrary command execution, file exfiltration, and further post-exploitation activity. The IP address hosting the payload has been previously flagged as malicious infrastructure.

At time of analysis only 5 antivirus engines detected the sample as malicious, indicating low detection coverage for this macOS-targeted campaign. The lure theme (cryptocurrency/Bitcoin interview) suggests targeting of individuals or organizations in the crypto/financial space, though no specific victim organization or attribution is confirmed in the source material.

Mentioned in this report

Malware Meterpreter

Detection guidance

VBA Macro Executing System Commands via libc on macOS

ATT&CK T1059.005

Word macro on macOS invoking libc.dylib functions (popen/system) to execute shell commands - sandbox escape technique for persistence. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: VBA Macro Executing System Commands via libc on macOS
description: Detects Microsoft Office VBA macros on macOS calling libc.dylib's popen
  or system functions to execute arbitrary shell commands. This bypasses Word's sandbox
  restrictions and is a known sandbox-escape pattern used for malicious persistence.
tags:
- attack.execution
- attack.t1059.005
- attack.defense-evasion
- attack.t1027
logsource:
  product: macos
  category: process_creation
detection:
  selection:
    Image|endswith:
    - /Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
    - /Applications/Microsoft Office/Microsoft Word.app/Contents/MacOS/Microsoft Word
    CommandLine|contains:
    - popen
    - libc.dylib
    ParentImage|contains: soffice
  condition: selection
falsepositives:
- Legitimate Office VBA extensions or add-ins that legitimately call system functions
level: high
id: d8fc5570-0acd-5b06-bb44-7ae7f6860704
status: experimental
author: Vorant

LaunchAgent Plist Written by Office Process

ATT&CK T1543.001

Office process writing plist file to LaunchAgents directory - persistence mechanism bypassing sandbox. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: LaunchAgent Plist Written by Office Process
description: Detects Microsoft Office processes on macOS writing plist files to the
  LaunchAgents directory (~/.launchagents or /Library/LaunchAgents). This is a common
  persistence technique used by malicious macros to establish long-term footholds.
tags:
- attack.persistence
- attack.t1543.001
- attack.defense-evasion
logsource:
  product: macos
  category: file_event
detection:
  selection:
    Image|endswith:
    - Microsoft Word
    - Microsoft Excel
    - Microsoft PowerPoint
    TargetFilename|contains:
    - /.launchagents/
    - /Library/LaunchAgents/
    TargetFilename|endswith: .plist
  condition: selection
falsepositives:
- Legitimate Office extensions managing their own launch agents
level: high
id: e390d6ca-d411-52fe-9d69-b772cbae7503
status: experimental
author: Vorant

Base64-Encoded Python Execution from LaunchAgent

ATT&CK T1059.006

Python interpreter executing base64-encoded payload from LaunchAgent context - staged payload delivery pattern. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Base64-Encoded Python Execution from LaunchAgent
description: Detects Python processes executing base64-decoded payloads spawned from
  a LaunchAgent (parent process chain indicates persistence trigger). This is consistent
  with staged malware delivery where the first-stage loader decodes and executes obfuscated
  second-stage implants.
tags:
- attack.execution
- attack.t1059.006
- attack.defense-evasion
- attack.t1140
logsource:
  product: macos
  category: process_creation
detection:
  selection:
    Image|endswith:
    - /usr/bin/python
    - /usr/bin/python3
    CommandLine|contains:
    - base64
    - b64decode
    - -c
    ParentImage|contains: launchd
  condition: selection
falsepositives:
- System automation scripts or admin tools that legitimately use Python with base64
  decoding
level: medium
id: ae803038-6714-5661-8928-e5c5ff44ea25
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://objective-see.org/blog/blog_0x3A.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free