#HITBLockdown D2 - Documents Of Doom: Infecting Macos Via Office Macros

Patrick, a principal security researcher, presents an analysis of macro-based attacks targeting macOS systems through Microsoft Office documents. Historically, macro exploits (originating from the Melissa virus in 1999) predominantly targeted Windows systems, but as macOS becomes more prevalent in enterprise environments with Microsoft Office installed, attackers have shifted focus to this growing user base.

The presentation examines three documented campaigns. In 2017, a Trump-themed document contained malicious macros that execute when enabled by users. In 2018, a Bitcoin-themed document featured base64-encoded Python code that downloaded an Empire backdoor and Metasploit meterpreter payload, and notably included Adam Chester's sandbox escape exploit that abused a faulty regex to create specially-named files circumventing Office's file creation restrictions. In 2019, a Lazarus group document (attributed to North Korea) distributed an M1.T persistent implant targeting macOS.

For analyzing embedded macros, the speaker details using oletools (ole_vba command) to extract macro code from Office documents. Payloads are typically base64-encoded and executed via the auto_open subroutine when users enable macros. Microsoft's attempted patch for the sandbox escape was incomplete, still allowing file writes to parent directories of the launch agents folder.

The core contribution is a novel 0-click exploit chain leveraging XLM macros—an ancient Excel macro format from the 1980s still supported by modern Microsoft Office—which execute automatically even when macros are disabled. The chain delivers an XLSX file containing XLM macros that download a specially-crafted ZIP file, persists it as a login item (allowed from within Office's sandbox), and on next user login, Archive Utility unpacks it. Through clever path construction, unpacking creates a launch agents directory containing a plist file that launches daemon executes as a bash reverse shell outside the sandbox. The attacker can then install additional malware without notarization constraints. Detection is possible by monitoring for Office spawning curl/Python child processes and suspicious ZIP file login item persistence. Apple patched the vulnerability in 10.15.3; Microsoft's response was reportedly minimal.