Cybercriminals have developed macro malware for the Mac platform. It’s the first time this technique has been spotted on the Apple platform. The attack works only on Mac versions of Word (attempts to execute on Windows or Pages failed). It sidesteps Apple s Gatekeeper protection which blocks unsigned code from executing; macros will execute since they re given permission to do so by the user. The attackers embedded a first stage component of EmPyre into the Word document and its sole purpose was to call out to the command infrastructure at securitychecking[.]org[.]443/index[.]asp.
Source: https://threatpost.com/macro-malware-comes-to-macos/123640/