Office Drama on macOS
Patrick Wardle analyzes emerging macOS macro-based Office malware campaigns, dissecting Apple sandbox escapes and synthetic click persistence tricks.
Summary
The Rise of Macro-Based Attacks on macOS
While Microsoft Office VBA macro attacks have targeted Windows for decades, adversary groups increasingly deploy weaponized Word and Excel documents targeting macOS enterprise workstations.
Deconstructing Real-World macOS Macro Payloads
Patrick Wardle analyzes recent nation-state and cybercrime documents, examining how malicious VBA code invokes Python, Bash, and native Objective-C APIs via MacScript.
Bypassing the Apple App Sandbox
Wardle uncovers vulnerabilities in macOS Office sandboxing, demonstrating how attackers escape sandbox constraints, write persistent login launch items, and access sensitive files.
Detection Engineering and Endpoint Defenses
The author releases open-source heuristic monitoring tools, providing macOS defenders with behavioral rules to detect malicious Office child process spawning.
Related talks
Main Stage·28 min
Patrick Wardle
Patrick Wardle answers questions on macOS malware heuristics, Microsoft Office sandbox escapes on macOS, and behavioral detections.
Main Stage·49 min
Patrick Wardle
Demonstrates how macOS malware authors abuse legitimate Apple APIs and signing to create persistent, undetected implants.
Main Stage·22 min
Andy Grant
Dissects macOS PKG installer internals to reveal how malware authors abuse the package format for persistence and privilege escalation.