CloudMensis is macOS spyware ESET found in April 2022 that uses pCloud, Yandex Disk and Dropbox to take commands and send out stolen documents, keystrokes and screen captures. It was used in targeted attacks and relied on known macOS flaws, so keeping macOS up to date is the main defense; to check, look for a hidden file named .com.apple.WindowServer.plist in /Library/LaunchDaemons.
Last reviewed · 1 source
Also known as: OSX.CloudMensis, Cloud Spy
ESET researchers found CloudMensis in April 2022; the earliest compromise they could date was February 4, 2022. It uses public cloud storage (pCloud, Yandex Disk and Dropbox) both to receive commands and to send out files. Its operators collect documents, spreadsheets, audio recordings, pictures, email messages, keystrokes and screen captures, and it can list files on removable storage. It avoids macOS's privacy (TCC) prompts by writing to the TCC database when System Integrity Protection is off, or by exploiting known vulnerabilities on Macs that aren't up to date. It persists as a system daemon from /Library/LaunchDaemons/.com.apple.WindowServer.plist, with its second stage at /Library/WebServer/share/httpd/manual/WindowServer. ESET still doesn't know how victims were first compromised.
Targeted operations against specific people; ESET saw very limited distribution
A first stage that downloads the spy agent from the attackers' pCloud storage
Known macOS vulnerabilities on Macs that aren't up to date
A hidden file /Library/LaunchDaemons/.com.apple.WindowServer.plist
A file named WindowServer in /Library/WebServer/share/httpd/manual
pCloud, Yandex Disk or Dropbox activity when you aren't using those services
Privacy permissions in System Settings that you don't remember granting
Turn off Wi-Fi and Ethernet to cut its cloud command channel and stop further uploads.
Delete /Library/LaunchDaemons/.com.apple.WindowServer.plist and /Library/WebServer/share/httpd/manual/WindowServer (both need an administrator password), then restart. The real WindowServer lives elsewhere in /System and isn't affected.
Look in ~/Library/LaunchAgents, /Library/LaunchAgents and /Library/LaunchDaemons and in System Settings › General › Login Items & Extensions for anything else you don't recognize.
In Terminal, tccutil reset All resets every app's privacy permissions; you'll grant them again to the apps you use. Then review System Settings › Privacy & Security.
CloudMensis relies on known vulnerabilities. Install all updates in System Settings › General › Software Update, and keep System Integrity Protection on.
CoreLock's free scan checks startup items. With Full Disk Access, its Privacy report lists apps macOS has granted Screen Recording, Accessibility, Full Disk Access, Input Monitoring, camera and microphone.
Keep macOS updated: CloudMensis used known vulnerabilities, not new ones
Leave System Integrity Protection on
Be careful with attachments and links you didn't expect, even from people you know
Review Privacy & Security permissions in System Settings from time to time
What it can and can't do
CloudMensis persists as a LaunchDaemon, which falls under the startup-items check in CoreLock's free scan. With Full Disk Access, CoreLock's free Privacy report lists the apps macOS has granted Screen Recording, Accessibility, Full Disk Access, Input Monitoring, camera and microphone; a grant isn't proof of use, malware that bypasses TCC may not appear as a grant at all, and CoreLock can't promise to catch it.
Trojan — Trend Micro described XCSSET in August 2020: it inserts code into local Xcode pr...
RAT — MITRE ATT&CK describes Proton as a macOS backdoor focused on data theft and cred...
Trojan — Lazarus Group is a North Korean state-sponsored group attributed to the Reconnai...
It uses public cloud storage, pCloud, Yandex Disk and Dropbox, for both its commands and its stolen files, so its traffic looks like ordinary cloud sync. It also works around macOS's privacy prompts to capture the screen, log keys and read removable drives.
Probably not. ESET says its very limited distribution suggests it's used in targeted operations against specific people. Keeping macOS up to date closes the known flaws it relies on.
If System Integrity Protection is off, the TCC database that stores your privacy choices isn't protected, and CloudMensis writes to it directly. Otherwise it exploits known vulnerabilities, which updates fix. ESET found, for example, that on macOS Catalina before 10.15.6 it could make tccd load a database it controls.
Known samples can be matched by signature, but its traffic is hard to tell from normal Dropbox or pCloud sync. Checking for its daemon and binary at the paths above is more reliable than watching the network.
Free, with no account: the scan checks your Downloads folder against a built-in malware-hash list and 19 YARA rules.
Apple silicon build 2.0.7 · Intel Mac?
For your Mac, not this phone ·
Count which apps can record your screen, use your mic or camera, or read your files, and get a free 0–100 estimate in your browser.
Estimate your Security ScoreFree · Calculated in your browser