One category of malware that has certainly affected Windows and not MacOS is the infamous Microsoft Word macro virus. That could be changing, as MacOS has now suffered its very first Word macro attack, as Ars Technica reports.
While Word macros can significantly enhance the application’s value, they’ve fallen out of favor over the years because of their tendency to be abused by malicious parties. Now, people who have used Word over the years probably think twice about clicking on the “enable macros” button that pops up when they open a document with embedded macros. MacOS users now also have good reason to hit the “disable macros” button instead unless they know for sure it’s from a safe source — or to discard the document entirely.
The malware in question comes via a Word document, “U.S. Allies and Rivals Digest Trump’s Victory — Carnegie Endowment for International Peace,” that when opened runs embedded Python code that comes from the EmPyre open-source exploit framework. The code is capable of accessing webcams, grabbing passwords and encryption keys, and snooping into browser histories — and the infection it creates is persistent. Before running, it checks to make sure that the Littlesnitch security firewall isn’t active.
As usual, the Word macro malware relies on the user clicking through the warning. Patrick Wardle, Director of Research at Synack, a security company, said in an analysis of the Word document, “By using macros in Word documents, they are exploiting the weakest link; humans! And moreover since macros are ‘legitimate’ functionality (vs. say a memory corruption vulnerability) the malware’s infection vector doesn’t have to worry about crashing the system nor being ‘patched’ out.”
Another piece of malware that researchers also describe as unsophisticated and “poorly written” was recently discovered separately from the Word macro. Other attacks have been identified in the past few years, demonstrating that malicious parties are starting to pay more attention to MacOS — enough so that Mac users should seriously consider installing some antivirus and antimalware software. It’s simply no longer true that it’s only Windows users who are vulnerable to attack.
