How To: Empire’s Cross Platform Office Macro

This article describes a proof-of-concept technique for creating a single macro-enabled Office document that can compromise both Windows and macOS hosts by detecting the OS at runtime and launching the appropriate stager (PowerShell for Windows, Python/EmPyre for macOS). It provides step-by-step guidance for generating stagers with PowerShell Empire/EmPyre, embedding them in Office macros, and testing execution, noting limitations on older Mac Office builds and environments that restrict access to required libraries.