In plain words
Think of your computer like a house where you only want to let in trusted visitors. A malicious Word document is like a fake delivery person who gets into your house by pretending to be someone you trust. Once inside, they can do damage. In this case, the malicious document targets macOS users.
What's broken
The malicious Word document has embedded macros¹ which are like a set of instructions that the document can execute on your computer. These macros can download additional malicious software, known as a 2nd-stage payload², from the internet. The document also contains an embedded downloader³ which is used to retrieve this payload.
How it actually works
Here's how it actually works: when you open the malicious Word document on your Mac, it runs the embedded macros¹. These macros then activate the embedded downloader³, which connects to a remote server on the internet to download the 2nd-stage payload². Once the payload is downloaded, it can be executed on your computer, potentially giving the attacker control over your system. The macros and downloader work together like a key and a lock, where the macro is the key that unlocks the downloader, which then opens the door to the payload.
Proof of concept
There is a public analysis of this malicious document, which demonstrates how the embedded macros and downloader work together to retrieve the 2nd-stage payload. This analysis serves as a proof of concept⁴, showing that the flaw in the document is real and can be exploited. The proof of concept proves that the malicious document can indeed download and execute malicious software on a Mac, making it a significant threat.
Is it real
It is not clear from the source if this malicious document is being actively exploited in the wild. However, the fact that it targets macOS users and can download additional malicious software makes it a potential threat. One limiting factor could be that macros need to be enabled in Word for the exploit to work, which may not be the default setting for all users.
What to do
To protect yourself from such threats, it's essential to be cautious when opening Word documents from unknown sources. Keeping your operating system and software up to date, and avoiding enabling macros in documents from untrusted sources, can help mitigate this risk.
Terms
- ¹ macros
- , A set of instructions that can be executed by an application, in this case, Word.
- ² 2nd-stage payload
- , Additional malicious software downloaded from the internet after the initial exploit.
- ³ embedded downloader
- , A component used to download additional malicious software from the internet.
- ⁴ proof of concept
- , A demonstration that a security flaw is real and can be exploited, often by showing how an attack works.