The malware 'isn't particularly advanced,' suggests security researcher Patrick Wardle of Synack, due to requiring interaction from users to open the document and needing macros to be enabled. These modules offered a multitude of options for attackers to acquire data, including keyloggers, Keychain dumps, clipboard monitoring, taking screenshots, accessing iMessage, and even an attached webcam. Allies and Rivals Digest Trump's Victory - Carnegie Endowment for International Peace' It is thought the payload would try to persist on the Mac, automatically running after a reboot, and then could perform functions based on one of many EmPyre modules. While the payload file is now inaccessible, making it impossible to know what exactly happened to victims, researchers found some second-stage components of EmPyre code that hints at what would take place. The python code itself is sourced from the open-source EmPyre project, an existing post-exploitation framework, with the code used 'almost verbatim.'

If run with macros enabled, the automatic macro starts to run python script, which first checks if network monitoring tool Little Snitch is running, before attempting to download a second-stage payload from a specific URL, decrypting the payload, and then executing its contents. The notice warns that macros could contain viruses, and gives the option to continue opening the file with and without macros enabled, as well as to back out from opening it at all. Allies and Rivals Digest Trump's Victory - Carnegie Endowment for International Peace' is noted in research compiled by Objective-See to show a usual Word macro warning when it is attempted to be opened by potential victims.

Mac word processor with macros