EvilClippy
EvilClippy is a cross-platform tool that creates malicious MS Office documents with hidden VBA macros and evasion techniques for penetration testing and red team operations.
EvilClippy is a cross-platform tool that creates malicious MS Office documents with hidden VBA macros and evasion techniques for penetration testing and red team operations.
Checked October 2026.
EvilClippy is a cross-platform tool designed to create malicious Microsoft Office documents for security testing purposes.
The tool provides capabilities to hide VBA macros within Office documents, making them less detectable by standard security analysis tools. It can perform VBA code stomping through P-Code manipulation, which replaces the readable VBA source code with compiled bytecode while maintaining functionality.
EvilClippy is specifically designed to confuse and evade macro analysis tools that organizations use to detect malicious Office documents. The tool supports multiple operating systems including Linux, OSX, and Windows, providing flexibility for different testing environments.
The primary use case for EvilClippy is in penetration testing and red team operations where security professionals need to create realistic phishing attack scenarios. It enables testers to evaluate an organization's defensive capabilities against sophisticated Office-based threats.
The tool focuses on Microsoft Office document manipulation and provides various evasion techniques that mirror real-world attack methods used by malicious actors.
No core features are listed for this product yet, so check the vendor's documentation for the full feature list.
No integrations are listed for this product yet. Check the vendor's documentation, or ask the vendor which integrations and APIs it supports.
Common questions about EvilClippy: features, pricing and alternatives.
EvilClippy is a product in the Red-Team & Adversary Emulation category. It covers Red Team, Office 365 and Evasion.
EvilClippy is free. Download and setup instructions are at https://github.com/outflanknl/EvilClippy/.
Alternatives to EvilClippy listed on CybersecTools:
Compare all EvilClippy alternatives at https://cybersectools.com/alternatives/evilclippy
EvilClippy is available as on-premises software. It is listed for mid-market companies and enterprises. It is free.
Side by side: features, pricing model and the company behind each one.
Ebowla is a tool for generating payloads in Python, GO, and PowerShell with support for Reflective DLLs.
Customize Empire's GET request URIs, user agent, and headers for evading detection and masquerading as other applications.
AI-powered continuous pentesting platform combining autonomous agents with human hackers.
A standalone man-in-the-middle attack framework used for phishing login credentials and bypassing 2-factor authentication.
A Python framework for building custom Command and Control interfaces that implements Cobalt Strike's External C2 specification for data transfer between frameworks.
A library for integrating communication channels with the Cobalt Strike External C2 server.
Get a summary of this page from your assistant.
Mandos MCP: ask about all 9,030 products.
Connect your AI
