# EvilClippy

EvilClippy is a Red-Team & Adversary Emulation product. It runs on-premises. Pricing is free.

EvilClippy is a cross-platform tool that creates malicious MS Office documents with hidden VBA macros and evasion techniques for penetration testing and red team operations.

Checked October 2026.

## What is EvilClippy?

EvilClippy is a cross-platform tool designed to create malicious Microsoft Office documents for security testing purposes.

The tool provides capabilities to hide VBA macros within Office documents, making them less detectable by standard security analysis tools. It can perform VBA code stomping through P-Code manipulation, which replaces the readable VBA source code with compiled bytecode while maintaining functionality.

EvilClippy is specifically designed to confuse and evade macro analysis tools that organizations use to detect malicious Office documents. The tool supports multiple operating systems including Linux, OSX, and Windows, providing flexibility for different testing environments.

The primary use case for EvilClippy is in penetration testing and red team operations where security professionals need to create realistic phishing attack scenarios. It enables testers to evaluate an organization's defensive capabilities against sophisticated Office-based threats.

The tool focuses on Microsoft Office document manipulation and provides various evasion techniques that mirror real-world attack methods used by malicious actors.

Tags: Red Team, Office 365, Evasion, Microsoft, Payload Generation

## Quick facts

- Category: [Offensive Security](https://cybersectools.com/categories/offensive-security-testing) · [Red-Team & Adversary Emulation](https://cybersectools.com/categories/offensive-security)
- Deployment: On-Premises
- Company size fit: Mid-Market, Enterprise
- Pricing model: Free
- GitHub stars: 2,235
- Website: github.com

## EvilClippy FAQ

### What is EvilClippy?

EvilClippy is a product in the Red-Team & Adversary Emulation category. It covers Red Team, Office 365 and Evasion.

### What is the pricing for EvilClippy?

EvilClippy is free. Download and setup instructions are at https://github.com/outflanknl/EvilClippy/.

### What are alternatives to EvilClippy?

Alternatives to EvilClippy listed on CybersecTools:

1. [Fortra Cobalt Strike](https://cybersectools.com/tools/fortra-cobalt-strike) - Threat emulation product for adversary simulations and red team operations (Commercial)
2. [Core Security Outflank Security Tooling](https://cybersectools.com/tools/core-security-outflank-security-tooling) - Red team toolkit for EDR evasion, initial access, and post-exploitation. (Commercial)
3. [GoSecure Titan® Adversarial Simulation](https://cybersectools.com/tools/gosecure-titanr-adversarial-simulation) - Human-led adversary emulation service testing detection & response capabilities (Commercial)
4. [Dreadnode Offensive Security Agents](https://cybersectools.com/tools/dreadnode-offensive-security-agents) - AI agent platform for automating offensive security operations and evals. (Commercial)
5. [Red Specter Cheatsheet](https://cybersectools.com/tools/red-specter-cheatsheet) - CLI cheatsheet for Red Specter's 30-tool offensive security platform. (Commercial)

Compare all EvilClippy alternatives at [https://cybersectools.com/alternatives/evilclippy](https://cybersectools.com/alternatives/evilclippy)

### What deployment and organization size does EvilClippy fit?

EvilClippy is available as on-premises software. It is listed for mid-market companies and enterprises. It is free.

## Compare EvilClippy with similar solutions

- [EvilClippy vs Fortra Cobalt Strike](https://cybersectools.com/compare/evilclippy-vs-fortra-cobalt-strike)
- [EvilClippy vs Core Security Outflank Security Tooling](https://cybersectools.com/compare/core-security-outflank-security-tooling-vs-evilclippy)
- [EvilClippy vs GoSecure Titan® Adversarial Simulation](https://cybersectools.com/compare/evilclippy-vs-gosecure-titanr-adversarial-simulation)

All alternatives to EvilClippy: [/alternatives/evilclippy](https://cybersectools.com/alternatives/evilclippy)

---

Source: https://cybersectools.com/tools/evilclippy

For AI agents: every CybersecTools shortlist is listed at https://cybersectools.com/shortlists.md, and any compare page has a Markdown copy too (add .md to its URL).

More on EvilClippy: funding, momentum, hiring and news, plus the full product and company record, are available through the Mandos MCP Server (paid plans), which connects to AI assistants: https://mandos.io/mcp?utm_source=cybersectools.com&utm_medium=product-md