{"id":4376,"date":"2012-04-04T12:55:14","date_gmt":"2012-04-04T19:55:14","guid":{"rendered":"http:\/\/www.intego.com\/mac-security-blog\/?p=4376"},"modified":"2016-02-12T10:15:19","modified_gmt":"2016-02-12T18:15:19","slug":"windows-hacker-tool-creates-word-documents-that-can-infect-macs","status":"publish","type":"post","link":"https:\/\/www.intego.com\/mac-security-blog\/windows-hacker-tool-creates-word-documents-that-can-infect-macs\/","title":{"rendered":"Windows Hacker Tool Creates Word Documents that Can Infect Macs"},"content":{"rendered":"

We recently published information about poisoned Word documents that can infect Macs with a backdoor<\/a>. These documents look like Word files, but, when double-clicked, after displaying text, they infect Macs with a backdoor. <\/p>\n

Intego’s Malware Research Team has found samples of a Windows tool called MalHost-Setup.exe which can be used to create this type of infected Word file. (It can also be used to create Excel and PowerPoint files, but Intego has not seen any samples of these files being used to deliver this type of malware yet.) The sample found included an infected Word file with Mac-specific payload.<\/p>\n

As we pointed out in our blog post, “the code in these Word documents is not encrypted, so any malware writer who gets copies of them may be able to alter the code and distribute their own versions of these documents.” This tool suggests that this type of infected Microsoft Office file will become more common.<\/p>\n

All users of Microsoft Office should make sure they have applied all the available security updates. The last security update for Office 2004 and 2008 was in December 2011<\/a>. Follow the link to download the appropriate update if your version of Office is not up to date. <\/p>\n","protected":false},"excerpt":{"rendered":"

Intego’s Malware Research Team has found samples of a Windows tool called MalHost-Setup.exe which can be used to create infected Word files that can target Macs.<\/p>\n","protected":false},"author":3,"featured_media":3673,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"spay_email":"","jetpack_publicize_message":"","jetpack_is_tweetstorm":false},"categories":[190,5],"tags":[62,174,86,87,91,149],"yoast_head":"\n\n\n\n\n\n\n\n\n\n\n\n\n\t\n\t\n\n\n\t\n\t\n\t\n