SecuriTricks

Clickfix on macOS: AppleScript Stealer, Terminal Phishing, and C2 Infrastructure

A sophisticated phishing campaign targeting macOS users employs a technique called Clickfix, which tricks victims into running terminal commands that execute malicious AppleScript. This script steals sensitive data including browser profiles, crypto wallets, and personal files. The attackers use fa…

phishing

data theft

Published: August 22, 2025

Downloadable IOCs: 0

Think before you Click(Fix): Analyzing the ClickFix social engineering technique

The ClickFix social engineering technique has gained popularity among threat actors, targeting thousands of devices globally. It tricks users into executing malicious commands on their devices by exploiting their tendency to solve minor technical issues. The technique often impersonates legitimate …

atomic macos stealer (amos)

lampion

2025-08-21

windows run dialog

Published: August 21, 2025

Downloadable IOCs: 10

CrossC2 Expanding Cobalt Strike Beacon to Cross-Platform Attacks

From September to December 2024, incidents involving CrossC2, an extension tool for Cobalt Strike Beacon on Linux, were confirmed. The attacker used CrossC2 along with other tools like PsExec, Plink, and Cobalt Strike to penetrate AD. A custom malware called ReadNimeLoader was used as a loader for …

Published: August 15, 2025

Downloadable IOCs: 0

Atomic macOS Stealer includes a backdoor for persistent access

The Atomic macOS Stealer (AMOS) has received a major update, now including an embedded backdoor for persistent access to compromised Mac devices. This upgrade allows attackers to maintain access, run remote tasks, and gain extended control over infected machines. The Russia-affiliated AMOS threat g…

Published: August 8, 2025

Downloadable IOCs: 6

Odyssey Stealer Malware Attacks macOS Users

A phishing campaign targeting macOS users employs a ClickFix technique to deliver the Odyssey Stealer malware. The attack uses a fake CAPTCHA verification page that executes without dropping a binary on the system. When users follow the instructions, they unknowingly execute a malicious AppleScript…

Published: August 7, 2025

Downloadable IOCs: 3

Evolution of macOS Odyssey Stealer: New Techniques & Signed Malware

A new variant of the Odyssey infostealer for macOS has been discovered, featuring code signing, notarization, and a persistent backdoor. The malware mimics a Google Meet updater and uses a SwiftUI-based 'Technician Panel' for social engineering. It steals sensitive data, including passwords, browse…

Published: July 17, 2025

Downloadable IOCs: 0

Crypto Wallets Continue to be Drained in Elaborate Social Media Scam

An ongoing social engineering campaign is targeting cryptocurrency users through fake startup companies impersonating AI, gaming, and Web3 firms. The scammers create elaborate facades using spoofed social media accounts and project documentation on platforms like Notion and GitHub. They contact vic…

Published: July 16, 2025

Downloadable IOCs: 1

macOS.ZuRu Resurfaces | Modified Khepri C2 Hides Inside Doctored Termius App

A new variant of macOS.ZuRu malware has been discovered, targeting users through a trojanized version of the Termius app. This backdoor, initially noted in 2021, now uses a modified Khepri C2 framework for post-infection operations. The malware is delivered via a .dmg disk image containing a hacked…

Published: July 10, 2025

Downloadable IOCs: 4

macOS NimDoor | North Korean Threat Actors Target Web3 and Crypto Platforms with Nim-Based Malware

DPRK threat actors are targeting Web3 and crypto-related businesses using Nim-compiled binaries and multiple attack chains. The malware, dubbed NimDoor, employs unusual techniques for macOS, including process injection and encrypted WebSocket communications. It uses a novel persistence mechanism le…

Published: July 4, 2025

Downloadable IOCs: 9

Hiding in GitHub

An AMOS malware campaign has been discovered utilizing GitHub repositories to distribute malicious files. The attackers created a fake Ledger Live app that prompts users to enter their secret phrases, which are then exfiltrated. The malware uses obfuscation techniques, including base64 encoding and…

Published: June 20, 2025

Downloadable IOCs: 4

Inside the BlueNoroff Web3 macOS Intrusion Analysis

A detailed analysis of a sophisticated intrusion targeting a cryptocurrency foundation employee is presented. The attack, attributed to the North Korean APT group BlueNoroff, began with a social engineering lure via Telegram, leading to the installation of malicious software disguised as a Zoom ext…

Published: June 19, 2025

Downloadable IOCs: 18

Additional Features of OtterCookie Malware Used by WaterPlum

The article discusses updates to the OtterCookie malware utilized by the North Korea-linked attack group WaterPlum. The malware has evolved through four versions, with v3 and v4 being the focus. OtterCookie v3 introduced Windows support and enhanced file collection capabilities. Version 4 added new…

financial institutions

Published: May 11, 2025

Downloadable IOCs: 0

Typosquatted Go Packages Deliver Malware Loader Targeting Li...

A malicious campaign is targeting the Go ecosystem with typosquatted packages that install hidden loader malware on Linux and macOS systems. The threat actor has published at least seven packages impersonating popular Go libraries, using array-based string obfuscation to hide malicious commands. Th…

Published: April 4, 2025

Downloadable IOCs: 0

Melting Pot of macOS Malware Adds Go to Crystal, Nim and Rust Variants

ReaderUpdate, a macOS malware loader platform active since 2020, has evolved to include variants written in Crystal, Nim, Rust, and now Go programming languages. Originally a compiled Python binary, the malware has been largely dormant until late 2024. The loader is capable of executing remote comm…

Published: March 26, 2025

Downloadable IOCs: 12

New XCSSET malware adds new obfuscation, persistence techniques to infect Xcode projects

Microsoft Threat Intelligence has discovered a new variant of XCSSET, a sophisticated macOS malware that infects Xcode projects. This latest version features enhanced obfuscation methods, updated persistence mechanisms, and new infection strategies. The malware steals and exfiltrates files, system …

Published: March 11, 2025

Downloadable IOCs: 31

North Korean-Linked macOS Malware Targets Cryptocurrency Sector with RustDoor and Koi Stealer

A recent campaign attributed to North Korean threat actors has been identified, targeting macOS users in the cryptocurrency industry. The attackers employ sophisticated social engineering techniques, posing as recruiters to lure job-seeking software developers into downloading malicious software. T…

Published: February 26, 2025

Downloadable IOCs: 21

Stealers on the Rise: A Closer Look at a Growing macOS Threat

This analysis examines the increasing prevalence of macOS infostealers, focusing on three prominent threats: Atomic Stealer, Poseidon Stealer, and Cthulhu Stealer. These malware variants target sensitive information, including financial details, credentials, and intellectual property. The article d…

Published: February 4, 2025

Downloadable IOCs: 26

macOS FlexibleFerret | Further Variants of DPRK Malware Family Unearthed

This intelligence analysis describes newly discovered variants of the DPRK-attributed macOS Ferret malware family, labeled as 'FlexibleFerret'. The malware is part of the ongoing 'Contagious Interview' campaign targeting developers and job seekers. The new variants include a dropper package contain…

multi_frostyferret_cmdcodes

Published: February 4, 2025

Downloadable IOCs: 2

Unmasking SparkRAT: Detection & macOS Campaign Insights

SparkRAT, a versatile malware tool, continues to pose a significant threat due to its modular design and cross-platform support. Recent investigations have uncovered new infrastructure associated with a suspected DPRK campaign targeting macOS users. The analysis reveals techniques for detecting Spa…

xworm

macos

2025-01-31

Published: January 31, 2025

Downloadable IOCs: 0

2024 macOS Malware Review | Infostealers, Backdoors, and APT Campaigns Targeting the Enterprise

The year 2024 saw a significant increase in malware campaigns targeting macOS users in enterprise environments. Threats included infostealers disguised as business apps, sophisticated modular backdoors, and APT activities. Notable malware families included Amos Atomic infostealers, Backdoor Activat…

macos

2025-01-21

Published: January 21, 2025

Downloadable IOCs: 23

Banshee: The Stealer That "Stole Code" From MacOS XProtect

A new version of the Banshee macOS stealer, linked to Russian-speaking cybercriminals, has been monitored since September. This version went undetected for over two months, using a string encryption algorithm identical to Apple's XProtect antivirus engine. The malware targets browser credentials, c…

Published: January 9, 2025

Downloadable IOCs: 25

Meeten Malware: A Cross-Platform Threat to Crypto Wallets on macOS and Windows

A sophisticated scam targeting Web3 professionals has been identified, involving the Realst crypto stealer malware with variants for both macOS and Windows. The threat actors have created fake companies using AI-generated content to appear legitimate, cycling through various names like Meetio, Clus…

Published: December 7, 2024

Downloadable IOCs: 0

Fake AI video generators infect Windows, macOS with infostealers

Threat actors are using fake AI image and video generators to distribute Lumma Stealer and AMOS information-stealing malware on Windows and macOS. These malicious programs masquerade as an AI application called EditProAI, targeting users through search results and social media advertisements. The m…

Published: November 16, 2024

Downloadable IOCs: 0

New threat targeting macOS discovered

Jamf Threat Labs uncovered malware samples linked to North Korea, built using Flutter, which provides inherent obfuscation. The malware, discovered in late October, includes Go, Python, and Flutter variants. The Flutter-built application presents a minesweeper game while making network requests to …

Published: November 13, 2024

Downloadable IOCs: 0

BlueNoroff used macOS malware with novel persistence

SentinelLabs researchers identified a North Korea-linked threat actor targeting crypto businesses with new macOS malware as part of a campaign called 'Hidden Risk'. The attackers, linked to BlueNoroff, used fake cryptocurrency news emails and a malicious app disguised as a PDF to deliver multi-stag…

Published: November 8, 2024

Downloadable IOCs: 0

Stealers on the rise: Kral, AMOS, Vidar and ACR

This intelligence report analyzes the increasing prevalence of information stealers, focusing on Kral, AMOS, Vidar, and ACR. Kral, delivered by its downloader, targets cryptocurrency wallets and browser data. AMOS, a macOS stealer, spreads through malvertising impersonating Homebrew. Vidar distribu…

Published: October 21, 2024

Downloadable IOCs: 0

New macOS vulnerability, "HM Surf", could lead to unauthorized data access

A new macOS vulnerability called 'HM Surf' has been discovered that could allow attackers to bypass the Transparency, Consent, and Control (TCC) technology and gain unauthorized access to protected user data. The exploit involves removing TCC protection for the Safari browser directory and modifyin…

Published: October 18, 2024

Downloadable IOCs: 0

Beware: Fake Google Meet Pages Deliver Infostealers in Ongoing ClickFix Campaign

Threat actors are using fake Google Meet web pages as part of the ClickFix campaign to deliver infostealers targeting Windows and macOS systems. The attackers display fake error messages in web browsers, tricking users into executing malicious PowerShell code. The campaign has expanded to impersona…

Published: October 18, 2024

Downloadable IOCs: 0

Gleaming Pisces Poisoned Python Packages Campaign Delivers PondRAT Linux and MacOS Backdoors

Unit 42 researchers have uncovered an ongoing campaign involving poisoned Python packages that deliver Linux and macOS backdoors. The attackers, believed to be the North Korean-affiliated group Gleaming Pisces, uploaded malicious packages to PyPI. The campaign's objective appears to be gaining acce…

Published: September 19, 2024

Linked vulnerabilities : CVE-2024-3400, CVE-2024-3094

Downloadable IOCs: 16

New macOS malware gives attackers backdoor access to Macs

A new remote access Trojan (RAT) targeting macOS systems, dubbed HZ RAT, grants remote attackers complete control over infected Macs. The malware collects sensitive data, such as installed apps, user information from WeChat and DingTalk, and Google Password Manager credentials. It's suspected of sp…

Published: September 16, 2024

Downloadable IOCs: 25

A SOC Team’s Guide to Detecting macOS Atomic Stealers

This article provides an analysis of the Atomic Infostealer malware family, which has been targeting macOS users throughout 2024. It discusses the various evolving variants, such as Amos, Banshee, Cthulu, Poseidon, and RodrigoStealer, developed and distributed by competing threat actor groups. The …

Published: September 13, 2024

Downloadable IOCs: 3

Atomic macOS Stealer leads sensitive data theft on macOS

The report discusses the Atomic macOS Stealer (AMOS), an infostealer malware targeting macOS systems. It is designed to steal sensitive information like passwords, cookies, cryptocurrency wallets, and other data from infected machines. The malware is distributed through malvertising, SEO poisoning,…

Published: September 9, 2024

Downloadable IOCs: 17

HZ Rat backdoor for macOS harvests data from WeChat and DingTalk

A version of the HZ Rat backdoor targeting users of China’s WeChat and DingTalk was uploaded to VirusTotal in July 2023 and was not detected by any vendor, research by Kaspersky suggests.

Published: August 27, 2024

Downloadable IOCs: 10

From the Depths: Analyzing the Cthulhu Stealer Malware for macOS

This report analyzes Cthulhu Stealer, a malware-as-a-service targeting macOS users to steal credentials and cryptocurrency wallets. It explores the malware's functionality, including prompting users for passwords, dumping keychain data, and exfiltrating stolen information. The analysis compares Cth…

Published: August 23, 2024

Downloadable IOCs: 9

TodoSwift Disguises Malware Download Behind Bitcoin PDF

This report details a macOS threat actor likely originating from North Korea that employs a dropper application written in Swift/SwiftUI. The dropper presents the user with a seemingly legitimate Bitcoin pricing PDF while simultaneously downloading and executing a malicious payload. The malware's t…

Published: August 19, 2024

Downloadable IOCs: 7

Beyond the wail: deconstructing the BANSHEE infostealer

This analysis details the BANSHEE malware, a macOS-based infostealer that targets system information, browser data, and cryptocurrency wallets. Developed by Russian threat actors, it operates across macOS x86_64 and ARM64 architectures. The malware is designed to evade detection through anti-debugg…

Published: August 16, 2024

Downloadable IOCs: 2

InfoStealer Uses SwiftUI, OpenDirectory API to Capture Passwords

This report analyzes a new macOS stealer malware that leverages SwiftUI for password prompts and the OpenDirectory API for verifying captured passwords. It utilizes APIs to evade detection and carries out malicious operations in distinct stages, first executing a Swift-based dropper that displays a…

Published: August 9, 2024

Downloadable IOCs: 1

Fake Microsoft Teams for Mac delivers Atomic Stealer

A malvertising campaign lures Mac users into downloading a counterfeit Microsoft Teams installer containing Atomic Stealer, a data-stealing malware. The campaign uses advanced filtering techniques, compromised ad accounts, and decoy pages to deliver unique payloads that bypass security measures. Up…

Published: July 12, 2024

Downloadable IOCs: 6

Self-Proclaimed Meeting Software Vortax Spreads Infostealers, Unveils Expansive Network of Malicious macOS Applications

While monitoring data in Recorded Future Malware Intelligence, Insikt Group identified purported virtual meeting software called Vortax that, upon download and installation, delivers three information stealers (“infostealers”) in cross-platform attacks — Rhadamanthys, Stealc, and, most notably, Ato…

macos

c2

2024-06-20

Published: June 20, 2024

Downloadable IOCs: 60

LightSpy: Implant for macOS

A technical analysis reveals details about LightSpy, a sophisticated surveillance framework that targeted macOS devices using publicly available exploits. The report provides insights into the threat actor's tactics, including exploiting vulnerabilities to deliver implants, exfiltrating private dat…

Published: May 30, 2024

Linked vulnerabilities : CVE-2018-4404, CVE-2018-4233

Downloadable IOCs: 43

macOS Cuckoo Stealer | Ensuring Detection and Defense as New Samples Rapidly Emerge

This analysis discusses the emergence of a new macOS malware family called 'Cuckoo Stealer', which acts as an infostealer and spyware. It describes Cuckoo Stealer's main features, logic, and provides indicators of compromise to assist threat hunters and defenders. The malware employs techniques lik…

Published: May 10, 2024

Downloadable IOCs: 4

macOS Adload Pivots Just Days After Apple’s XProtect Clampdown

The report analyzes a new variant of the Adload adware that evades Apple's recent XProtect malware signature updates. Despite Apple adding 74 new rules targeting Adload in XProtect version 2192, the adware authors have rapidly modified their code to bypass these detections. The report examines a sp…

Published: May 1, 2024

Downloadable IOCs: 11

LightSpy Malware Variant Targeting macOS

This report details the discovery of a macOS variant of the LightSpy malware, previously known to target iOS and Android devices. The macOS implant consists of a dropper that downloads and runs a core implant dylib, which in turn loads various plugins to accomplish malicious tasks. The report provi…

Published: April 29, 2024

Downloadable IOCs: 12

Tag: macos

Attack reports

MacSync Stealer Evolves: From ClickFix to Code-Signed Swift Malware

AI-Poisoning & AMOS Stealer: How Trust Became the Biggest Mac Threat

The Hidden Dangers of Calendar Subscriptions: 4 Million Devices at Risk

macOS Malware Deploys in Fake Job Scams

NovaStealer - Apple Intelligence is leaving a plist.. it is legit, right?

The ClickFix Factory: First Exposure of IUAM ClickFix Generator

XCSSET evolves again: Analyzing the latest updates to XCSSET's inventory

Fake Empire Podcast Invites Target Crypto Industry with macOS AMOS Stealer

Learn about ChillyHell, a modular Mac backdoor

An Analysis of the AMOS Stealer Campaign Targeting macOS via 'Cracked' Apps

Traps Beneath Fault Repair: Analysis of Recent Attacks Using ClickFix Technique

Clickfix on macOS: AppleScript Stealer, Terminal Phishing, and C2 Infrastructure

Think before you Click(Fix): Analyzing the ClickFix social engineering technique

CrossC2 Expanding Cobalt Strike Beacon to Cross-Platform Attacks

Atomic macOS Stealer includes a backdoor for persistent access

Odyssey Stealer Malware Attacks macOS Users

Evolution of macOS Odyssey Stealer: New Techniques & Signed Malware

Crypto Wallets Continue to be Drained in Elaborate Social Media Scam

macOS.ZuRu Resurfaces | Modified Khepri C2 Hides Inside Doctored Termius App

macOS NimDoor | North Korean Threat Actors Target Web3 and Crypto Platforms with Nim-Based Malware

Hiding in GitHub

Inside the BlueNoroff Web3 macOS Intrusion Analysis

Additional Features of OtterCookie Malware Used by WaterPlum

Typosquatted Go Packages Deliver Malware Loader Targeting Li...

Melting Pot of macOS Malware Adds Go to Crystal, Nim and Rust Variants

New XCSSET malware adds new obfuscation, persistence techniques to infect Xcode projects

North Korean-Linked macOS Malware Targets Cryptocurrency Sector with RustDoor and Koi Stealer

Stealers on the Rise: A Closer Look at a Growing macOS Threat

macOS FlexibleFerret | Further Variants of DPRK Malware Family Unearthed

Unmasking SparkRAT: Detection & macOS Campaign Insights

2024 macOS Malware Review | Infostealers, Backdoors, and APT Campaigns Targeting the Enterprise

Banshee: The Stealer That "Stole Code" From MacOS XProtect

Meeten Malware: A Cross-Platform Threat to Crypto Wallets on macOS and Windows

Fake AI video generators infect Windows, macOS with infostealers

New threat targeting macOS discovered

BlueNoroff used macOS malware with novel persistence

Stealers on the rise: Kral, AMOS, Vidar and ACR

New macOS vulnerability, "HM Surf", could lead to unauthorized data access

Beware: Fake Google Meet Pages Deliver Infostealers in Ongoing ClickFix Campaign

Gleaming Pisces Poisoned Python Packages Campaign Delivers PondRAT Linux and MacOS Backdoors

New macOS malware gives attackers backdoor access to Macs

A SOC Team’s Guide to Detecting macOS Atomic Stealers

Atomic macOS Stealer leads sensitive data theft on macOS

HZ Rat backdoor for macOS harvests data from WeChat and DingTalk

From the Depths: Analyzing the Cthulhu Stealer Malware for macOS

TodoSwift Disguises Malware Download Behind Bitcoin PDF

Beyond the wail: deconstructing the BANSHEE infostealer

InfoStealer Uses SwiftUI, OpenDirectory API to Capture Passwords

Fake Microsoft Teams for Mac delivers Atomic Stealer

Self-Proclaimed Meeting Software Vortax Spreads Infostealers, Unveils Expansive Network of Malicious macOS Applications

LightSpy: Implant for macOS

macOS Cuckoo Stealer | Ensuring Detection and Defense as New Samples Rapidly Emerge

macOS Adload Pivots Just Days After Apple’s XProtect Clampdown

LightSpy Malware Variant Targeting macOS