MS Office exploit that targets MacOS X seen in the wild

> An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

I don't quite understand this. Form the article it looks like the trojan escapes the word document to execution realm through your typical vulnerability. Fair enough. But so far it looks like it only has rights corresponding to the user.

So as far as i understand it, this needs a privilege escalation vulnerability to 'take complete control' and 'create new accounts'.

It seems to copy itself to /Library/launched though, which here is

    drwr-xr-x+ 65 root wheel 2210 Feb  2 14:45 /Library

So it looks like it's going root at some point, but it's not described in the document. But since it has root, why would ' Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights'?

This is why we need sandboxing on the mac. I wonder whether there are particular barriers for Microsoft to add that sooner rather than later?

Who else is with me on this? Fucking MS Office.