StrangerealIntel analyzes a Kimsuky intrusion chain that begins with a malicious Office document using remote template injection to fetch a second-stage macro from crphone.mireene.com. On macOS, the macro uses Office's bundled Python 2.7 support to execute fileless Python code, replace normal.dotm for persistence, gather system and file-listing data from user directories, compress the collection into backup.zip, and upload it to the same C2 infrastructure. The report also covers a Windows PowerShell implant from the same campaign, showing cross-platform tradecraft built around Office macros, in-memory scripting, persistence through template abuse, and HTTP-based collection staging.