{"id":68943,"date":"2017-02-14T12:56:57","date_gmt":"2017-02-14T20:56:57","guid":{"rendered":"https:\/\/securingtomorrow.mcafee.com\/?p=68943"},"modified":"2025-06-02T19:25:50","modified_gmt":"2025-06-03T02:25:50","slug":"macro-malware-targets-macs","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/macro-malware-targets-macs\/","title":{"rendered":"Macro Malware Targets Macs"},"content":{"rendered":"<p>Macro malware has been spreading for years. New techniques arise all the time to hide malicious code and thus increase the difficulty of analysis. However, just targeting Microsoft Windows no longer seems to be enough for the malware authors. The Mac appears to be the new challenge, and attackers appear to be rising to this challenge.<\/p>\n<p>In previous versions of macro threats, the malicious code was hidden in user forms and macros in Microsoft Office files. (See <a href=\"https:\/\/securingtomorrow.mcafee.com\/mcafee-labs\/macro-malware-associated-dridex-finds-new-ways-hide\/\" target=\"_blank\" rel=\"noopener\">Macro Malware Associated With Dridex Finds New Ways to Hide<\/a>.) The latest member of this family seems to have learned a new trick or two, as we now will see.<\/p>\n<ul>\n<li>The malicious code is now hidden in the properties of Excel worksheet files:<\/li>\n<\/ul>\n<p style=\"text-align: center;\"><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/02\/Yerko-MAC-1.png\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-68967 aligncenter\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/02\/Yerko-MAC-1-300x225.png\" alt=\"\" width=\"601\" height=\"451\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/02\/Yerko-MAC-1-300x225.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/02\/Yerko-MAC-1-768x577.png 768w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/02\/Yerko-MAC-1-1024x769.png 1024w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/02\/Yerko-MAC-1-666x500.png 666w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/02\/Yerko-MAC-1.png 1032w\" sizes=\"auto, (max-width: 601px) 100vw, 601px\" \/><\/a><em>A malicious Excel file ready to be executed.<\/em><\/p>\n<p style=\"text-align: center;\"><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/02\/MAC-3.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-68957\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/02\/MAC-3-300x226.png\" alt=\"\" width=\"594\" height=\"447\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/02\/MAC-3-300x226.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/02\/MAC-3-768x577.png 768w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/02\/MAC-3-1024x770.png 1024w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/02\/MAC-3-665x500.png 665w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/02\/MAC-3.png 1027w\" sizes=\"auto, (max-width: 594px) 100vw, 594px\" \/><\/a><em>When the file is opened we see this\u00a0message.<\/em><\/p>\n<p style=\"text-align: center;\"><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/02\/MACS-3.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-68976\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/02\/MACS-3-300x225.jpg\" alt=\"\" width=\"594\" height=\"446\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/02\/MACS-3-300x225.jpg 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/02\/MACS-3-768x575.jpg 768w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/02\/MACS-3-1024x767.jpg 1024w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/02\/MACS-3-668x500.jpg 668w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/02\/MACS-3.jpg 1031w\" sizes=\"auto, (max-width: 594px) 100vw, 594px\" \/><\/a><em>If we access the file&#8217;s properties, we can read the Powershell script code.<\/em><\/p>\n<p style=\"text-align: center;\"><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/02\/MAC-7.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-68962\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/02\/MAC-7-300x154.png\" alt=\"\" width=\"594\" height=\"305\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/02\/MAC-7-300x154.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/02\/MAC-7-768x395.png 768w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/02\/MAC-7-1024x527.png 1024w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/02\/MAC-7-971x500.png 971w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/02\/MAC-7.png 1896w\" sizes=\"auto, (max-width: 594px) 100vw, 594px\" \/><\/a><em>The full content in Properties.<\/em><\/p>\n<p style=\"text-align: center;\"><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/02\/Properties-content4.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-68982\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/02\/Properties-content4.jpg\" alt=\"\" width=\"370\" height=\"86\" \/><\/a><em>Location of hidden content.<\/em><\/p>\n<p style=\"text-align: center;\"><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/02\/Properties-content5.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-68983\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/02\/Properties-content5-300x13.jpg\" alt=\"\" width=\"646\" height=\"28\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/02\/Properties-content5-300x13.jpg 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/02\/Properties-content5.jpg 552w\" sizes=\"auto, (max-width: 646px) 100vw, 646px\" \/><\/a><em>An extract of the Powershell content.<\/em><\/p>\n<ul>\n<li>The malicious code runs Powershell, which downloads malware after the victim enables macros.<\/li>\n<\/ul>\n<p><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/02\/MAC-2.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-68956\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/02\/MAC-2-300x224.png\" alt=\"\" width=\"594\" height=\"443\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/02\/MAC-2-300x224.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/02\/MAC-2-768x574.png 768w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/02\/MAC-2-1024x766.png 1024w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/02\/MAC-2-669x500.png 669w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/02\/MAC-2.png 1030w\" sizes=\"auto, (max-width: 594px) 100vw, 594px\" \/><\/a><\/p>\n<ul>\n<li>The macro searches for the hidden code in Properties and runs it using Powershell, but this works only on Windows systems. How does the malicious code execute on the Mac?\u00a0The malware developers use MacScript:<\/li>\n<\/ul>\n<p style=\"text-align: center;\"><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/02\/Yerko-MAC-5.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-68963\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/02\/Yerko-MAC-5-300x226.png\" alt=\"\" width=\"595\" height=\"448\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/02\/Yerko-MAC-5-300x226.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/02\/Yerko-MAC-5-768x577.png 768w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/02\/Yerko-MAC-5-1024x770.png 1024w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/02\/Yerko-MAC-5-665x500.png 665w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/02\/Yerko-MAC-5.png 1028w\" sizes=\"auto, (max-width: 595px) 100vw, 595px\" \/><\/a><\/p>\n<p style=\"text-align: center;\">The macro code verifies whether WScript.Shell is present. In case of an error, the code executes the module macshell:<\/p>\n<p style=\"text-align: center;\"><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/02\/MAC-6-iphidden.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-68961\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/02\/MAC-6-iphidden-300x91.png\" alt=\"\" width=\"782\" height=\"237\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/02\/MAC-6-iphidden-300x91.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/02\/MAC-6-iphidden-768x234.png 768w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/02\/MAC-6-iphidden-1024x311.png 1024w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/02\/MAC-6-iphidden-1644x500.png 1644w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/02\/MAC-6-iphidden.png 1894w\" sizes=\"auto, (max-width: 782px) 100vw, 782px\" \/><\/a><\/p>\n<p style=\"text-align: center;\"><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/02\/Macro_Content2-3-e1486515834831.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-68988\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/02\/Macro_Content2-3-e1486515834831-300x153.jpg\" alt=\"\" width=\"593\" height=\"302\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/02\/Macro_Content2-3-e1486515834831-300x153.jpg 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/02\/Macro_Content2-3-e1486515834831.jpg 525w\" sizes=\"auto, (max-width: 593px) 100vw, 593px\" \/><\/a><em>This script runs the code on the Mac. The script runs with the same permissions as Microsoft Office.<\/em><\/p>\n<p style=\"text-align: left;\">As we ran this analysis, the control server contacted by this malware sample was not running; so we were unable obtain the payload.<\/p>\n<h2 style=\"text-align: left;\">The MD5 hash for\u00a0the samples we found:<\/h2>\n<ul>\n<li style=\"text-align: left;\">952A36F4231C8628ACEA028B4145DAEC<\/li>\n<\/ul>\n<h2>Full descriptions of the W97M and X97M malware families are available in\u00a0our Threat Advisories:<\/h2>\n<ul>\n<li><a href=\"https:\/\/kc.mcafee.com\/resources\/sites\/MCAFEE\/content\/live\/PRODUCT_DOCUMENTATION\/25000\/PD25689\/en_US\/McAfee_Labs_Threat_Advisory-W97MDownloader_X97MDownloader.pdf\" target=\"_blank\" rel=\"noopener\">W97M\/Downloader and X97M\/Downloader Threat Advisory<\/a><\/li>\n<\/ul>\n<h2 style=\"text-align: left;\">During our analysis, the malware attempted contacted the following server (with URL modified for safety):<\/h2>\n<ul>\n<li style=\"text-align: left;\">hxxp:\/\/ndur0.net<\/li>\n<\/ul>\n<p>McAfee advises users to keep their antimalware signatures up to date at all times. McAfee products detect this malicious Office Trojan as X97M\/Downloader.bf.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Macro malware has been spreading for years. New techniques arise all the time to hide malicious code and thus increase&#8230;<\/p>\n","protected":false},"author":770,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[442],"tags":[40,1814,76,4452,180],"coauthors":[4486],"class_list":["post-68943","post","type-post","status-publish","format-standard","hentry","category-mcafee-labs","tag-apple","tag-computer-security","tag-cybercrime","tag-cybersecurity","tag-malware"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v25.4 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Macro Malware Targets Macs | McAfee Blog<\/title>\n<meta name=\"description\" content=\"Macro malware has been spreading for years. New techniques arise all the time to hide malicious code and thus increase the difficulty of analysis.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Macro Malware Targets Macs | McAfee Blog\" \/>\n<meta property=\"og:description\" content=\"Macro malware has been spreading for years. New techniques arise all the time to hide malicious code and thus increase the difficulty of analysis.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/macro-malware-targets-macs\/\" \/>\n<meta property=\"og:site_name\" content=\"McAfee Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/yerko.grbic\" \/>\n<meta property=\"article:published_time\" content=\"2017-02-14T20:56:57+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-06-03T02:25:50+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/02\/Yerko-MAC-1.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1032\" \/>\n\t<meta property=\"og:image:height\" content=\"775\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Yerko Grbic\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@Yerko_Grbic\" \/>\n<meta name=\"twitter:site\" content=\"@McAfee\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Yerko Grbic\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/macro-malware-targets-macs\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/macro-malware-targets-macs\/\"},\"author\":{\"name\":\"Yerko Grbic\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/6f3d786f48d4d3aa0ffaf0d54a53bc4f\"},\"headline\":\"Macro Malware Targets Macs\",\"datePublished\":\"2017-02-14T20:56:57+00:00\",\"dateModified\":\"2025-06-03T02:25:50+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/macro-malware-targets-macs\/\"},\"wordCount\":363,\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/macro-malware-targets-macs\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/02\/Yerko-MAC-1-300x225.png\",\"keywords\":[\"Apple\",\"computer security\",\"cybercrime\",\"cybersecurity\",\"malware\"],\"articleSection\":[\"McAfee Labs\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/macro-malware-targets-macs\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/macro-malware-targets-macs\/\",\"name\":\"Macro Malware Targets Macs | McAfee Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/macro-malware-targets-macs\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/macro-malware-targets-macs\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/02\/Yerko-MAC-1-300x225.png\",\"datePublished\":\"2017-02-14T20:56:57+00:00\",\"dateModified\":\"2025-06-03T02:25:50+00:00\",\"description\":\"Macro malware has been spreading for years. New techniques arise all the time to hide malicious code and thus increase the difficulty of analysis.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/macro-malware-targets-macs\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/macro-malware-targets-macs\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/macro-malware-targets-macs\/#primaryimage\",\"url\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/02\/Yerko-MAC-1-300x225.png\",\"contentUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/02\/Yerko-MAC-1-300x225.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/macro-malware-targets-macs\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Blog\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Other Blogs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"McAfee Labs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"Macro Malware Targets Macs\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"name\":\"McAfee Blog\",\"description\":\"Internet Security News\",\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\",\"name\":\"McAfee\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"width\":1286,\"height\":336,\"caption\":\"McAfee\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/x.com\/McAfee\",\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/www.youtube.com\/McAfee\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/6f3d786f48d4d3aa0ffaf0d54a53bc4f\",\"name\":\"Yerko Grbic\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/8592f4bde0c38a3626ed4a7451ed3bdb\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/02\/Yerko-Grbic-96x96.jpg\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/02\/Yerko-Grbic-96x96.jpg\",\"caption\":\"Yerko Grbic\"},\"sameAs\":[\"https:\/\/www.facebook.com\/yerko.grbic\",\"https:\/\/www.linkedin.com\/in\/yerko-grbic-reyes-a56a1622\/\",\"https:\/\/x.com\/Yerko_Grbic\"],\"url\":\"https:\/\/www.mcafee.com\/blogs\/author\/yerko-grbic\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Macro Malware Targets Macs | McAfee Blog","description":"Macro malware has been spreading for years. New techniques arise all the time to hide malicious code and thus increase the difficulty of analysis.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"og_locale":"en_US","og_type":"article","og_title":"Macro Malware Targets Macs | McAfee Blog","og_description":"Macro malware has been spreading for years. New techniques arise all the time to hide malicious code and thus increase the difficulty of analysis.","og_url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/macro-malware-targets-macs\/","og_site_name":"McAfee Blog","article_publisher":"https:\/\/www.facebook.com\/McAfee\/","article_author":"https:\/\/www.facebook.com\/yerko.grbic","article_published_time":"2017-02-14T20:56:57+00:00","article_modified_time":"2025-06-03T02:25:50+00:00","og_image":[{"width":1032,"height":775,"url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/02\/Yerko-MAC-1.png","type":"image\/png"}],"author":"Yerko Grbic","twitter_card":"summary_large_image","twitter_creator":"@Yerko_Grbic","twitter_site":"@McAfee","twitter_misc":{"Written by":"Yerko Grbic","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/macro-malware-targets-macs\/#article","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/macro-malware-targets-macs\/"},"author":{"name":"Yerko Grbic","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/6f3d786f48d4d3aa0ffaf0d54a53bc4f"},"headline":"Macro Malware Targets Macs","datePublished":"2017-02-14T20:56:57+00:00","dateModified":"2025-06-03T02:25:50+00:00","mainEntityOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/macro-malware-targets-macs\/"},"wordCount":363,"publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/macro-malware-targets-macs\/#primaryimage"},"thumbnailUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/02\/Yerko-MAC-1-300x225.png","keywords":["Apple","computer security","cybercrime","cybersecurity","malware"],"articleSection":["McAfee Labs"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/macro-malware-targets-macs\/","url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/macro-malware-targets-macs\/","name":"Macro Malware Targets Macs | McAfee Blog","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/macro-malware-targets-macs\/#primaryimage"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/macro-malware-targets-macs\/#primaryimage"},"thumbnailUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/02\/Yerko-MAC-1-300x225.png","datePublished":"2017-02-14T20:56:57+00:00","dateModified":"2025-06-03T02:25:50+00:00","description":"Macro malware has been spreading for years. New techniques arise all the time to hide malicious code and thus increase the difficulty of analysis.","breadcrumb":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/macro-malware-targets-macs\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/macro-malware-targets-macs\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/macro-malware-targets-macs\/#primaryimage","url":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/02\/Yerko-MAC-1-300x225.png","contentUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/02\/Yerko-MAC-1-300x225.png"},{"@type":"BreadcrumbList","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/macro-malware-targets-macs\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https:\/\/www.mcafee.com\/blogs\/"},{"@type":"ListItem","position":2,"name":"Other Blogs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/"},{"@type":"ListItem","position":3,"name":"McAfee Labs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/"},{"@type":"ListItem","position":4,"name":"Macro Malware Targets Macs"}]},{"@type":"WebSite","@id":"https:\/\/www.mcafee.com\/blogs\/#website","url":"https:\/\/www.mcafee.com\/blogs\/","name":"McAfee Blog","description":"Internet Security News","publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.mcafee.com\/blogs\/#organization","name":"McAfee","url":"https:\/\/www.mcafee.com\/blogs\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","width":1286,"height":336,"caption":"McAfee"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/McAfee\/","https:\/\/x.com\/McAfee","https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/www.youtube.com\/McAfee"]},{"@type":"Person","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/6f3d786f48d4d3aa0ffaf0d54a53bc4f","name":"Yerko Grbic","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/8592f4bde0c38a3626ed4a7451ed3bdb","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/02\/Yerko-Grbic-96x96.jpg","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/02\/Yerko-Grbic-96x96.jpg","caption":"Yerko Grbic"},"sameAs":["https:\/\/www.facebook.com\/yerko.grbic","https:\/\/www.linkedin.com\/in\/yerko-grbic-reyes-a56a1622\/","https:\/\/x.com\/Yerko_Grbic"],"url":"https:\/\/www.mcafee.com\/blogs\/author\/yerko-grbic\/"}]}},"_links":{"self":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/68943","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/users\/770"}],"replies":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/comments?post=68943"}],"version-history":[{"count":2,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/68943\/revisions"}],"predecessor-version":[{"id":214929,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/68943\/revisions\/214929"}],"wp:attachment":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/media?parent=68943"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/categories?post=68943"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/tags?post=68943"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/coauthors?post=68943"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}