Mac malware and threats

Banshee Stealer appeared in mid-2024 and was rented out for $3,000 a month through Telegram and the XSS and Exploit forums (Check Point Research, Elastic Security Labs).

Kandji found Cuckoo in 2024 in a universal app named DumpMediaSpotifyMusicConverter, then in converters from tunesolo, fonedog, tunesfun and tunefab, all offering to convert streaming music to MP3.

ClickFix is a social-engineering technique that MITRE ATT&CK lists as User Execution: Malicious Copy and Paste (T1204.004).

Cado Security (now part of Darktrace) found Cthulhu Stealer rented out by the 'Cthulhu Team' over Telegram for $500 a month, with affiliates paid a share for spreading it.

Atomic Stealer (AMOS) is a macOS information stealer that Cyble found advertised on Telegram in April 2023 for $1,000 a month, sold together with a .dmg installer.

Realst is a macOS information stealer written in Rust.

Uptycs found MacStealer advertised on the dark web in March 2023, sold as builds (the seller asked $100 per build).

Jamf Threat Labs described RustBucket in April 2023 and suspects a North Korean state-sponsored actor; others attribute it to BlueNoroff, a part of the Lazarus Group focused on financial theft.

ESET researchers found CloudMensis in April 2022; the earliest compromise they could date was February 4, 2022.

Silver Sparrow is an activity cluster Red Canary reported in February 2021.

EvilQuest, also named ThiefQuest, was found in 2020 in trojanized pirated Mac apps, such as an unsigned copy of the DJ app Mixed In Key (Objective-See).

Trend Micro described XCSSET in August 2020: it inserts code into local Xcode projects so the payload runs when the project builds, and it can hijack Safari and inject JavaScript into web pages.

Microsoft traced UpdateAgent from a basic information stealer in September 2020 to a distributor of second-stage payloads by October 2021.

Shlayer is a macOS dropper that installs adware and potentially unwanted programs.

Lazarus Group is a North Korean state-sponsored group attributed to the Reconnaissance General Bureau and active since at least 2009 (MITRE ATT&CK).

CoinMiner is a label for macOS malware that mines cryptocurrency on the victim's Mac for the attacker.

AdLoad is one of the most widespread adware loaders on macOS and has been around since at least 2017 (SentinelLabs).

MITRE ATT&CK describes Proton as a macOS backdoor focused on data theft and credential access; it was offered for sale on underground forums in early 2017.

Check Point found OSX/Dok in April 2017.

KeRanger was hidden in two installers of Transmission 2.90 that were posted on Transmission's own website on March 4, 2016.

Pirrit has been known on Windows since 2014, and a Mac version was spotted in 2016 (Check Point).

Bitdefender disclosed Backdoor.MAC.Eleanor in July 2016.

MITRE ATT&CK describes Bundlore as macOS adware in use since at least 2015 that, though categorized as adware, has many features associated with more traditional backdoors.

OSX.VSearch is Malwarebytes' name for a family of macOS adware that is usually installed by bundlers; it can turn text on web pages into hyperlinks and show pop-ups unrelated to the sites you have open.

Genieo is a browser hijacker that behaves like adware: it acts as a search engine that shows sponsored results and is usually installed by bundled installers (Malwarebytes).