Phishing with Office Macros Using PowerShell Empire Stagers: A Guide to AV Evasion

Phishing remains one of the most prevalent and effective cyberattack techniques used by threat actors to compromise individuals and organizations. By exploiting human psychology and technical vulnerabilities, attackers can deliver malicious payloads that lead to data breaches, ransomware infections, or long-term system control. One sophisticated approach in phishing attacks involves the use of Office macros paired with PowerShell Empire stagers, allowing attackers to bypass security controls and establish persistent access on compromised systems.

What Is PowerShell Empire?

PowerShell Empire is an open-source post-exploitation framework that has gained popularity in both offensive security and cybercriminal circles. It provides a modular, flexible platform for attackers to control compromised hosts using PowerShell, a powerful scripting environment native to Windows operating systems. Unlike traditional malware, PowerShell Empire relies on living-off-the-land techniques, using built-in Windows tools and scripting capabilities to remain stealthy and evade detection.

The framework is designed to deploy stages, which are small, initial payloads that establish communication between the attacker’s command and control (C2) server and the victim’s machine. Once a stager is executed, the attacker gains remote control, enabling further exploitation such as privilege escalation, lateral movement, and data exfiltration. Stagers are crucial because they represent the first foothold on the target system and must be delivered and executed without raising suspicion.

Why Office Macros Are a Popular Attack Vector

Office macros are scripts written in Visual Basic for Applications (VBA) embedded inside Microsoft Office documents such as Word, Excel, or PowerPoint files. Originally designed to automate repetitive or complex tasks, macros can execute code directly on a user’s system when enabled. This automation capability, while useful for productivity, also opens the door for exploitation.

Attackers embed malicious PowerShell commands or scripts inside macros, which are then triggered when a user opens the document and enables macros. Because Office documents are common and trusted business tools, phishing emails containing such documents are more likely to bypass initial suspicion and security filters. The trick lies in persuading the recipient to enable macros, which is often disabled by default in modern Office installations due to the associated risks.

The Role of Phishing in Delivering Malicious Office Macros

Phishing emails act as the delivery mechanism for malicious Office documents. Crafting an effective phishing email requires a combination of social engineering and technical preparation. Attackers typically impersonate trusted entities such as colleagues, business partners, or official organizations, using realistic language and urgent calls to action to compel users to open attachments or click links.

The email will often include an attachment—a document containing a malicious macro designed to download or execute a PowerShell Empire stager. The success of this attack depends heavily on convincing the recipient to enable macros, which may involve fake warnings, instructions, or deceptive content inside the document itself. The attacker might add messages like “Enable macros to view content” or “This document is protected for your security, please enable editing and macros.”

Common Antivirus Detection Methods and Their Limitations

Antivirus and endpoint security solutions traditionally rely on signature-based detection methods that scan files and scripts for known malicious patterns. This includes identifying suspicious macro code, PowerShell commands, or network traffic associated with command and control servers. Additionally, behavioral analysis attempts to detect unusual activity such as unauthorized PowerShell execution or network connections to suspicious domains.

However, attackers continuously adapt to these defenses by modifying their payloads, using obfuscation techniques, and leveraging legitimate system tools to mask their actions. PowerShell Empire stagers often employ base64 encoding, string concatenation, and runtime code generation to evade static detection. The living-off-the-land approach minimizes new file creation, making it harder for traditional antivirus software to identify malicious behavior.

How PowerShell Empire Stagers Work in Office Macros

The core idea behind embedding PowerShell Empire stagers in Office macros is to use the macro to execute a PowerShell command directly on the victim’s system. When the user enables macros, the VBA script runs and launches a PowerShell process, often with encoded or obfuscated commands. This PowerShell command either downloads the full payload from a remote server or executes the payload inline.

Stagers usually establish an outbound connection to the attacker’s C2 server, which allows the attacker to control the compromised host remotely. Because these connections are often encrypted and use common protocols like HTTP or HTTPS, they blend in with normal network traffic. This stealthy communication channel is vital for maintaining control without triggering network security alerts.

The Importance of Understanding This Attack Vector

Phishing attacks using Office macros combined with PowerShell Empire stagers pose a significant threat because they exploit common user behaviors and trusted software. Despite improvements in email filtering, endpoint detection, and user education, these attacks remain successful due to their technical sophistication and effective social engineering tactics.

For security professionals, penetration testers, and defenders, understanding how these attacks are constructed and deployed is essential to building effective defenses. This knowledge helps in creating detection rules, improving incident response procedures, and designing user awareness programs that reduce risk.

Real-World Examples of Macro-Based Phishing Attacks

Several high-profile cyber incidents have involved the use of malicious Office macros to deliver post-exploitation frameworks similar to PowerShell Empire. Attackers targeting government agencies, financial institutions, and large enterprises have successfully compromised networks by sending spear-phishing emails with weaponized Office documents.

One notable example involved a sophisticated threat actor targeting defense contractors by sending Word documents disguised as confidential project reports. When recipients enabled macros, a PowerShell Empire stager was executed, allowing the attacker to move laterally within the network and exfiltrate sensitive data over several months undetected.

Challenges in User Behavior and Security Awareness

One of the biggest hurdles in preventing macro-based phishing attacks is user behavior. Many organizations struggle to enforce strict policies around macro usage because some legitimate business processes depend on macros. This creates a tension between usability and security.

Despite repeated training and warnings, users may still enable macros, especially if the email appears urgent or from a trusted source. Attackers exploit this tendency by crafting convincing messages and documents that lower the victim’s guard. Improving user awareness, combined with technical controls, is critical to reducing successful macro attacks.

 

PowerShell Empire stagers embedded in Office macros represent a powerful and dangerous phishing attack vector. The combination of social engineering and technical evasion tactics makes it difficult for traditional security solutions to detect and prevent these threats. Understanding how PowerShell Empire works, why macros are exploited, and how phishing campaigns deliver these payloads is vital for anyone involved in cybersecurity defense or penetration testing.

The following article in this series will delve into the practical side, showing how to create and embed PowerShell Empire stagers inside Office macros and deliver them via phishing emails. This foundation is essential for grasping the mechanics behind one of today’s most challenging phishing threats and how attackers evade detection to maintain access on compromised machines.

Creating and Embedding PowerShell Empire Stagers in Office Macros

Building on the understanding of PowerShell Empire and how Office macros can be weaponized for phishing, this part focuses on the practical steps involved in creating a PowerShell Empire stager, embedding it into an Office macro, and preparing the phishing document for delivery. Mastery of these techniques requires both technical skill and awareness of how to evade antivirus detection while maintaining stealth.

Setting Up PowerShell Empire for Stager Generation

PowerShell Empire offers a variety of stager modules that can be customized to fit specific operational requirements. Before embedding a stager into an Office macro, it is essential to configure the payload according to the target environment and evasion strategies.

First, an operator sets up the Empire server, which hosts the command and control infrastructure. This server listens for incoming connections from compromised hosts and allows the attacker to issue commands remotely. Stagers are created with specific parameters, including communication protocols, encryption options, and obfuscation settings.

When generating a stager, operators can choose from various launcher types, such as PowerShell one-liners, base64-encoded scripts, or encoded commands that execute without creating suspicious artifacts on the disk. These launchers are designed to run in memory, making detection more difficult.

Crafting the PowerShell Stager Command

The core of the stager is a PowerShell command that the Office macro will execute. This command must be compact, efficient, and evade signature-based detection by antivirus products.

A typical PowerShell Empire stager command includes techniques like base64 encoding of the script, using environment variables or string concatenation to obfuscate command strings, and employing compressed payloads to reduce its footprint. This encoding makes it harder for security tools to recognize the payload from static scans.

For example, the launcher might appear as a single-line command like:

powershell

CopyEdit

powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand <base64_string>

 

The -NoProfile flag prevents loading user PowerShell profiles, reducing noise and potential interference. The -ExecutionPolicy Bypass allows the script to run without policy restrictions, which helps evade security controls that limit script execution.

Embedding the Stager in a VBA Macro

Once the PowerShell stager command is finalized, it is embedded into a Visual Basic for Applications (VBA) macro inside a Microsoft Office document. This macro will trigger the PowerShell command when the document is opened and the user enables macros.

To do this, the attacker opens an Office application like Word or Excel, accesses the VBA editor, and inserts the malicious macro code into a new module. The VBA code typically uses the Shell function to execute the PowerShell command in a hidden window, avoiding any visible prompts to the user.

A simple VBA snippet might look like this:

vba

CopyEdit

Sub AutoOpen()

    Dim cmd As String

    cmd = “powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand <base64_string>”

    Shell cmd, vbHide

End Sub

 

The AutoOpen subroutine ensures that the macro runs automatically when the document is opened. Alternatively, macros can be attached to other triggers like Document_Open or button clicks.

Techniques for Macro Obfuscation and Evasion

To increase the likelihood of bypassing antivirus detection, attackers often obfuscate their VBA code. This can include splitting the PowerShell command string into multiple parts and concatenating them at runtime, inserting dummy variables and functions, or using Unicode characters to confuse static scanners.

For example, instead of a straightforward string assignment, the command might be broken into chunks:

vba

CopyEdit

Dim part1 As String

Dim part2 As String

part1 = “powershell.exe -NoProfile -ExecutionPolicy Bypass “

part2 = “-EncodedCommand <base64_string>”

Shell part1 & part2, vbHide

Obfuscation also involves encoding strings or employing variable renaming to make the macro harder to analyze. Such techniques are common in advanced phishing campaigns and are necessary for successful evasion.

Preparing the Office Document for Distribution

After embedding and testing the macro, the next step is to prepare the Office document for phishing delivery. Attackers often tailor the document’s appearance to appear legitimate and relevant to the target, using logos, familiar formatting, and convincing language.

The document may include instructions prompting the recipient to enable macros, such as a fake message saying the content is protected or requires enabling macros to view. These social engineering elements are critical for overcoming the default macro disablement in Office.

Attackers may also leverage file naming conventions that suggest urgency or importance, such as “Invoice_2025.docx” or “Contract_Update.xlsm,” to entice the target to open the file.

Testing Against Antivirus and Endpoint Protection

Before deploying the phishing campaign, attackers typically test their macro-enabled documents against popular antivirus and endpoint detection tools. This ensures that the stage and macro code are not flagged during initial scanning.

This testing phase involves running the document in sandbox environments, antivirus products, and endpoint detection and response (EDR) tools to identify any triggers. Based on the results, the attacker may tweak obfuscation levels, alter the PowerShell command, or change delivery tactics to improve stealth.

Email Delivery Techniques for Macro Phishing

The phishing email serves as the final delivery vector for the malicious Office document. Attackers employ a variety of tactics to maximize the likelihood of success:

• Spoofing trusted senders or using compromised email accounts to appear legitimate.

• Crafting compelling subject lines and email bodies that create a sense of urgency or importance.

• Embedding links to download the document from cloud storage or attaching the document directly.

• Using email obfuscation and payload encryption techniques to bypass spam filters and sandboxing systems.

Additionally, attackers often monitor campaign effectiveness and adjust tactics based on user engagement and detection rates.

Mitigating the Risks

Understanding how PowerShell Empire stagers are embedded into Office macros and delivered via phishing emails highlights the importance of a layered defense approach. Mitigations include disabling macros by default and only allowing trusted macros to run, using advanced email filtering with attachment and link scanning, and implementing endpoint protections that monitor script execution behavior.

User education is also critical, teaching employees to recognize suspicious emails, avoid enabling macros from unknown sources, and report phishing attempts promptly.

 

This part provided a detailed walkthrough of creating PowerShell Empire stagers, embedding them into Office macros, and preparing the malicious documents for phishing distribution. Each step involves careful consideration of evasion techniques to bypass antivirus detection and maintain stealth on target systems.

The next article will focus on how to detect and defend against these phishing attacks, including network indicators, endpoint monitoring, and user training strategies that can significantly reduce the risk posed by macro-based PowerShell Empire stagers.

Detecting and Defending Against PowerShell Empire Macro Phishing Attacks

As phishing attacks leveraging Office macros and PowerShell Empire stagers continue to evolve, defenders must develop robust detection and mitigation strategies to protect their environments. This part explores practical approaches to identifying these threats early, understanding their behavior, and implementing security controls that reduce the risk of successful compromise.

Recognizing Indicators of Compromise from Macro-Based Attacks

One of the primary challenges in detecting macro-based phishing attacks is their stealthy execution. However, several indicators of compromise (IOCs) can hint at the presence of malicious macros and PowerShell Empire activity:

• Unusual or unauthorized PowerShell processes spawning from Office applications such as WINWORD.EXE or EXCEL.EXE.

• PowerShell commands launched with suspicious flags such as -NoProfile and -ExecutionPolicy Bypass.

• Network connections from workstations to unknown or suspicious external IP addresses or domains, especially over common ports like 80 or 443.

• Creation or modification of registry keys related to persistence mechanisms or PowerShell script execution policies.

• Execution of base64-encoded PowerShell commands, which often indicate obfuscated scripts.

Security teams should correlate these signs with endpoint telemetry and network logs to identify potential compromises.

Monitoring PowerShell Execution and Script Behavior

Modern endpoint detection and response (EDR) solutions provide capabilities to monitor PowerShell usage closely. Enabling advanced PowerShell logging features within Windows can reveal script block execution and command line parameters, aiding in the identification of malicious activity.

Enabling Module Logging, Script Block Logging, and Transcription features via Group Policy provides granular insight into PowerShell scripts run on endpoints. Alerts can be configured to trigger on the execution of encoded commands, use of bypass flags, or invocation of network communication functions within PowerShell scripts.

Regular review of PowerShell logs helps distinguish legitimate administrative scripts from suspicious or unknown activity, especially when tied to Office process trees.

Email Security Controls to Filter Malicious Attachments

Since phishing emails are the delivery vector for macro-enabled Office documents, strong email security controls are vital. Email gateways should be configured to scan attachments for malicious content and enforce policies that block or quarantine documents containing macros unless they are from trusted sources.

Advanced sandboxing technologies simulate opening attachments in a controlled environment to detect malicious macro behavior before the email reaches the user. URL rewriting and link analysis further reduce the risk of phishing via links to malicious downloads.

Implementing Domain-based Message Authentication, Reporting & Conformance (DMARC), SPF, and DKIM helps prevent email spoofing, reducing the chance that phishing emails will bypass recipient filters.

User Awareness and Training Programs

Technical controls alone cannot fully prevent phishing attacks. User education remains a cornerstone of defense. Training programs should emphasize:

• Recognizing phishing email traits such as unexpected attachments, urgent requests, and inconsistent sender information.

• Avoid enabling macros in Office documents unless verified through trusted channels.

• Reporting suspicious emails promptly to security teams.

Simulated phishing campaigns can test user readiness and help reinforce good security hygiene by providing real-time feedback and targeted training.

Restricting Macro Execution and PowerShell Use

Organizations can implement strict policies to limit the execution of macros and PowerShell scripts to trusted sources. This may include:

• Configuring Office Group Policy settings to disable macros by default, allowing only digitally signed macros from known publishers.

• Enforce AppLocker or Windows Defender Application Control rules that restrict PowerShell execution to approved scripts or users.

• Disabling PowerShell version 2.0, which lacks advanced logging, and encouraging use of constrained language mode.

• Blocking or monitoring the execution of PowerShell from Office application processes, preventing macros from launching PowerShell directly.

These measures reduce the attack surface and limit the ability of macro-based stagers to execute undetected.

Network Monitoring and Threat Intelligence

Monitoring network traffic for anomalous patterns is another important layer of defense. Security teams should look for:

• Outbound connections to uncommon IP addresses or domains that do not match known business partners.

• Traffic exhibiting beaconing behavior, where compromised hosts periodically check in with C2 servers.

• Use of uncommon or suspicious protocols or encrypted channels could indicate covert communication.

Integrating threat intelligence feeds that provide information about known malicious domains or IPs can improve the detection of the PowerShell Empire C2 infrastructure.

Incident Response Considerations

When a macro-based phishing attack is suspected or detected, swift incident response is critical to limit damage. Steps include:

• Isolating affected endpoints to prevent lateral movement.

• Collecting and analyzing forensic artifacts such as PowerShell logs, network traffic, and Office document metadata.

• Identifying the initial phishing email to assess the scope and target users.

• Applying endpoint remediation actions, such as removing malicious scripts and updating security policies.

• Communicating with users and stakeholders to raise awareness and prevent further compromise.

Having predefined playbooks for macro phishing scenarios enhances response effectiveness.

Challenges in Detection and Defense

Attackers continually refine their techniques to evade detection, such as by using highly obfuscated macros, encrypting PowerShell payloads, or leveraging living-off-the-land binaries for payload delivery. Security teams must stay current with emerging threats and adapt detection rules accordingly.

Furthermore, balancing usability and security is challenging, especially in environments that rely on macros for legitimate business processes. Overly restrictive policies may disrupt workflows, so targeted risk-based approaches are recommended.

Detecting and defending against PowerShell Empire stager phishing attacks requires a combination of endpoint monitoring, email security, user training, and network analysis. By identifying behavioral indicators, restricting execution policies, and fostering awareness, organizations can reduce the risk posed by these sophisticated attacks.

The final article in this series will explore advanced evasion techniques used by PowerShell Empire stagers and outline best practices for building resilient security postures against evolving macro phishing threats.

Advanced Evasion Techniques and Building a Resilient Security Posture

In this final part of the series, we explore advanced evasion tactics employed by attackers using PowerShell Empire stagers embedded in Office macros and discuss how organizations can strengthen their defenses to withstand such sophisticated phishing attacks. Understanding these evolving techniques is crucial for developing a resilient cybersecurity strategy.

Polymorphic and Metamorphic Macro Code

Attackers increasingly use polymorphic and metamorphic techniques to alter the macro code with each iteration, making signature-based detection extremely difficult. Polymorphic macros change variable names, string encoding, or code structure every time the document is created, while metamorphic macros can rewrite themselves to produce functionally identical but syntactically different code.

This dynamic transformation hinders antivirus engines that rely on static signatures and forces defenders to rely more on behavior-based detection. Attackers may also introduce junk code, meaningless loops, or confusing control flows to complicate analysis.

Living-Off-the-Land (LotL) Techniques

To evade endpoint protections, attackers leverage legitimate system tools and binaries, known as living-off-the-land binaries (LoLBins), to execute their malicious payloads. PowerShell itself is considered a LoLBin, but macro stagers may also invoke other utilities such as certutil, bitsadmin, or mshta to download or run payloads.

Using LoLBins reduces the likelihood of triggering alarms since these tools are commonly used by system administrators. Attackers combine these utilities with obfuscated commands and encoded payloads to blend in with normal system activity.

Fileless Execution and In-Memory Payloads

Fileless malware execution is a hallmark of PowerShell Empire stagers. Instead of writing payloads to disk, attackers execute code directly in memory, significantly reducing forensic evidence and bypassing traditional antivirus scanning of files.

PowerShell’s Invoke-Expression and reflective loading techniques enable this in-memory execution. Macros launch PowerShell commands that download, decode, and execute stager payloads without touching the file system.

Detecting fileless attacks requires endpoint security tools capable of monitoring memory and script execution behavior rather than relying solely on file signatures.

Dynamic Command and Control Communication

PowerShell Empire stagers use sophisticated command and control (C2) communication methods to evade network detection. These include domain generation algorithms (DGAs) that produce numerous potential C2 domains, randomized beaconing intervals to avoid pattern detection, and encryption of data exchanges.

Attackers may use common web protocols like HTTP and HTTPS with legitimate headers to blend C2 traffic with normal browsing activity. Some stagers incorporate fallback mechanisms, switching between multiple C2 servers or protocols if blocked.

Understanding these patterns aids network defenders in crafting effective detection rules and blocking strategies.

Use of Multi-Stage Payloads

To further complicate detection, attackers often employ multi-stage payloads. The initial stager downloaded by the macro is typically small and simple to evade scanning, which then downloads more complex payloads or modules once a foothold is established.

This staged approach reduces the risk of early detection and provides flexibility to deploy different tools based on the target environment. Each stage may use different obfuscation and evasion techniques, requiring layered analysis.

Building a Resilient Security Posture

Combating these advanced evasion techniques demands a comprehensive security strategy:

• Implement application whitelisting to allow only approved macros and scripts.

• Deploy next-generation endpoint detection tools with behavior analytics and memory monitoring.

• Use network segmentation to limit lateral movement and isolate compromised systems quickly.

• Maintain up-to-date threat intelligence feeds and integrate them into security monitoring.

• Enforce strict patch management and vulnerability remediation to reduce exploitable attack surfaces.

• Conduct regular phishing simulations and user training to enhance detection and reporting.

• Adopt zero-trust principles, minimizing implicit trust even within internal networks.

Continuous Improvement and Incident Readiness

Security teams must adopt a proactive mindset, continuously tuning detection capabilities and incident response plans. Regularly analyzing attack trends, threat actor tactics, techniques, and procedures (TTPs) informs defensive measures.

Incident response playbooks should incorporate macro phishing scenarios, including forensic data collection, containment procedures, and recovery steps. Post-incident reviews provide lessons learned to improve resilience.

Final Thoughts

PowerShell Empire stagers embedded in Office macros represent a potent threat, blending social engineering, code obfuscation, and living-off-the-land tactics to bypass defenses. However, a layered security approach combining technology, process, and people can significantly reduce the risk of successful attacks.

By understanding attacker methodologies and investing in detection, prevention, and user education, organizations can build a robust defense against these evolving phishing threats and protect critical assets from compromise.

• Category: other