Office Drama on macOS

Overview: Patrick Wardle, principal security researcher at Jamf and creator of Objective-See, examines malicious Microsoft Office documents targeting macOS endpoints. The presentation explores the historical context of macro-based threats, real-world attack campaigns targeting Mac users, and practical analysis techniques using open-source tooling. Wardle also details a sandbox escape vulnerability that allowed malicious macros to bypass Apple's application sandbox and establish persistent system access.

Key Topics: - Microsoft Office VBA macro execution on macOS vs. Windows - Static analysis and macro extraction using oletools (olevba) - Real-world macOS attacks (2017 election lure, 2018 cryptocurrency lure, 2019 Lazarus APT group) - Sandbox escape via regex exception flaw to create persistent launch items

Technical Details: Patrick Wardle explains that while VBA macros have historically targeted Windows environments since the 1999 Melissa virus, the growing enterprise adoption of macOS and Microsoft Office has made Mac endpoints frequent targets. Unlike native macOS office applications (Pages, Numbers), Microsoft Office for Mac supports VBA macros. Attackers leverage the standard AutoOpen subroutine to automatically execute payload code as soon as a victim enables macros upon opening a malicious document. To analyze these files without manually parsing complex Office formats, Wardle demonstrates using olevba with the -c flag from the open-source oletools suite to extract embedded VBA streams directly to standard output.

Wardle details three prominent real-world campaigns targeting macOS. A 2017 sample disguised as a political document regarding the US presidential election triggered an AutoOpen subroutine named Fisher. The macro reconstructed a Base64-encoded string executed via Python, which checked whether endpoint security monitoring software (specifically Little Snitch) was active, downloaded an RC4-encrypted second-stage payload from an external domain, decrypted it, and executed Empire, an open-source Python post-exploitation framework. In 2019, North Korea's Lazarus APT group adopted macro-laced documents targeting macOS.

A 2018 cryptocurrency-themed document incorporated an embedded plist and Base64-encoded Python that downloaded and executed Metasploit's Meterpreter for remote access. Crucially, modern versions of Microsoft Office run inside an Apple app sandbox, preventing malicious macros from persisting backdoors or reading user files. However, this attack leveraged a sandbox escape discovered by researcher Adam Chester and published on Objective-See. The escape exploited a sandbox configuration exception containing a faulty regular expression, allowing sandboxed code to write files outside the sandbox. Attackers abused this vulnerability to drop a Launch Item plist that executes arbitrary code outside the sandbox context upon the user's next login.

Key Takeaways: Macro execution remains a potent threat on macOS despite sandbox mitigations, as flawed sandbox profile rules can allow complete container escapes. Security teams must monitor child process execution spawned by Microsoft Office (such as Python invoking network requests) and inspect LaunchAgents and LaunchDaemons directories for unauthorized persistence artifacts. Organizations should enforce macro disabling policies and deploy behavioral monitoring capable of detecting evasive techniques like checking for Little Snitch.

(AI summary — Gemini Flash)