VORANT. Threat Intelligence Research Create a free account

Bitcoin lure macro doc targets macOS Office

PublishedThe source gives no date · added Vorant ratingelevated threat Financial Services

Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

A malicious Word macro doc lures Bitcoin/crypto professionals, escapes Word's macOS sandbox, and drops a Meterpreter stager via Python.

Sourceobjective-see.org — open the original

What to check

Applies to
Whether this concerns you is not assessed; the names the report mentions are listed below.
Date
The source gives no publication date; the date shown is the day Vorant added the brief.

A Word document named BitcoinMagazine-Quidax_InterviewQuestions_2018.docm was discovered targeting macOS Office users under the guise of a Bitcoin interview questionnaire. Analysis of the embedded VBA macro revealed it uses libc.dylib's popen function to call system(), reproducing a previously published sandbox-escape technique (from a guest blog by Adam Chester) to write a malicious LaunchAgent plist to disk, bypassing Word's macOS sandbox restrictions that normally prevent persistence.

The LaunchAgent executes a base64-encoded first-stage Python payload that repeatedly attempts to connect to a remote server at 109.202.107.20 on port 9622, retrieving a second-stage payload over the socket. Analysts decoded and executed the retrieved payload, identifying it as Metasploit's Meterpreter, giving the attacker a feature-rich in-memory implant capable of arbitrary command execution, file exfiltration, and further post-exploitation activity. The IP address hosting the payload has been previously flagged as malicious infrastructure.

At time of analysis only 5 antivirus engines detected the sample as malicious, indicating low detection coverage for this macOS-targeted campaign. The lure theme (cryptocurrency/Bitcoin interview) suggests targeting of individuals or organizations in the crypto/financial space, though no specific victim organization or attribution is confirmed in the source material.

Mentioned in this report

Malware Meterpreter

Related reporting

Detection guidance

VBA Macro Executing System Commands via libc on macOS

ATT&CK T1059.005 · status experimental · needs macos process_creation logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general.

Word macro on macOS invoking libc.dylib functions (popen/system) to execute shell commands - sandbox escape technique for persistence. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: VBA Macro Executing System Commands via libc on macOS
description: Detects Microsoft Office VBA macros on macOS calling libc.dylib's popen
  or system functions to execute arbitrary shell commands. This bypasses Word's sandbox
  restrictions and is a known sandbox-escape pattern used for malicious persistence.
tags:
- attack.execution
- attack.t1059.005
- attack.stealth
- attack.t1027
logsource:
  product: macos
  category: process_creation
detection:
  selection:
    Image|endswith:
    - /Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word
    - /Applications/Microsoft Office/Microsoft Word.app/Contents/MacOS/Microsoft Word
    CommandLine|contains:
    - popen
    - libc.dylib
    ParentImage|contains: soffice
  condition: selection
falsepositives:
- Legitimate Office VBA extensions or add-ins that legitimately call system functions
level: high
id: d8fc5570-0acd-5b06-bb44-7ae7f6860704
status: experimental
author: Vorant

LaunchAgent Plist Written by Office Process

ATT&CK T1543.001 · status experimental · needs macos file_event logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general.

Office process writing plist file to LaunchAgents directory - persistence mechanism bypassing sandbox. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: LaunchAgent Plist Written by Office Process
description: Detects Microsoft Office processes on macOS writing plist files to the
  LaunchAgents directory (~/.launchagents or /Library/LaunchAgents). This is a common
  persistence technique used by malicious macros to establish long-term footholds.
tags:
- attack.persistence
- attack.t1543.001
logsource:
  product: macos
  category: file_event
detection:
  selection:
    Image|endswith:
    - Microsoft Word
    - Microsoft Excel
    - Microsoft PowerPoint
    TargetFilename|contains:
    - /.launchagents/
    - /Library/LaunchAgents/
    TargetFilename|endswith: .plist
  condition: selection
falsepositives:
- Legitimate Office extensions managing their own launch agents
level: high
id: e390d6ca-d411-52fe-9d69-b772cbae7503
status: experimental
author: Vorant

Base64-Encoded Python Execution from LaunchAgent

ATT&CK T1059.006 · status experimental · needs macos process_creation logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general.

Python interpreter executing base64-encoded payload from LaunchAgent context - staged payload delivery pattern. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Base64-Encoded Python Execution from LaunchAgent
description: Detects Python processes executing base64-decoded payloads spawned from
  a LaunchAgent (parent process chain indicates persistence trigger). This is consistent
  with staged malware delivery where the first-stage loader decodes and executes obfuscated
  second-stage implants.
tags:
- attack.execution
- attack.t1059.006
- attack.stealth
- attack.t1140
logsource:
  product: macos
  category: process_creation
detection:
  selection:
    Image|endswith:
    - /usr/bin/python
    - /usr/bin/python3
    CommandLine|contains:
    - base64
    - b64decode
    - -c
    ParentImage|contains: launchd
  condition: selection
falsepositives:
- System automation scripts or admin tools that legitimately use Python with base64
  decoding
level: medium
id: ae803038-6714-5661-8928-e5c5ff44ea25
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://objective-see.org/blog/blog_0x3A.html

Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the malware it names. The paid plans add the security research and news reporting the free tier leaves out.

It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.

Create a free account   What it costs