Enlarge (credit: Patrick Wardle)
Malicious Microsoft Word documents that abuse macros have long been the bane of Windows users. Now, security researchers have found what may be the first such real-world attack to infect Macs.
The attack was found in a Word file titled “U.S. Allies and Rivals Digest Trump’s Victory – Carnegie Endowment for International Peace.” When Mac users open the document in a Word application configured to allow macros and ignore a warning, an embedded macro automatically:
- checks to make sure the LittleSnitch security firewall isn’t running
- downloads an encrypted payload from hxxps://www.securitychecking.org:443/index.asp
- decrypts the payload using a hard-coded key and
- executes the payload
The code contained in the macro is written in the Python programming language. It was taken almost verbatim from EmPyre, an open-source exploit framework for Macs. By the time the researchers found the booby-trapped document, the securitychecking.org was no longer serving the payload, so it wasn’t possible to know precisely what it did. But the Empyre component the macro borrowed allowed for persistent infections that contained a wide range of capabilities, including monitoring webcams, stealing passwords and encryption keys stored in the keychain, and accessing browsing histories.