Eleanor is a 2016 macOS backdoor hidden in a fake file converter called EasyDoc Converter, which set up a Tor hidden service and a local web control panel so attackers could reach the Mac anonymously. If you have EasyDoc Converter, delete it and its launch items, and check Activity Monitor for tor or php processes you didn't start.
Last reviewed · 4 sources
Also known as: OSX.Eleanor, Backdoor.MAC.Eleanor
Bitdefender disclosed Backdoor.MAC.Eleanor in July 2016. EasyDoc Converter.app posed as a drag-and-drop file converter but only downloaded a script that registered three components at startup: a Tor hidden service, a local PHP web service that gives the attacker full control (files, shell commands, running apps, email with attachments), and a Pastebin agent that posts each Mac's unique Tor address. It used the open-source wacaw tool to capture images and video from the webcam. Malwarebytes reported it was offered as a free app on MacUpdate and wasn't signed with an Apple developer ID. XProtect 5368 (macOS 26.5, checked October 29, 2026) carries a signature named OSX.Eleanor.A.
A free 'EasyDoc Converter' app offered on MacUpdate (Malwarebytes)
Not signed with an Apple developer ID, so it only ran if you overrode Gatekeeper's warning
Downloaded from third-party portals that didn't check what they hosted
An app called EasyDoc Converter that never actually converts files
A process named tor in Activity Monitor that you didn't start
php or httpd processes you didn't start
Launch items added around the time you installed the converter
Remove EasyDoc Converter.app from /Applications or wherever it is, and the disk image it came in from ~/Downloads.
In Activity Monitor, quit any tor and php processes you didn't start, then delete the files behind them; Activity Monitor's Open Files and Ports tab shows where they live.
Check ~/Library/LaunchAgents, /Library/LaunchAgents and /Library/LaunchDaemons for plists created when you installed the converter, and Login Items in System Settings.
The backdoor gave full remote access, so change your passwords from another device, starting with email and banking.
CoreLock's free scan checks startup items, and its network check reports services listening on non-loopback addresses. A listener alone doesn't prove another device can connect.
Get apps from the Mac App Store or the developer's own site
Be wary of utilities with few reviews and no verifiable developer
Don't override Gatekeeper for apps from unidentified developers
If a utility does nothing it promised, delete it straight away
What it can and can't do
Eleanor registers its parts to run at startup, which the startup-items check in CoreLock's free scan covers, and CoreLock's network check reports services listening on non-loopback addresses. A listening address alone doesn't prove another device can connect, and CoreLock can't promise to catch every variant.
RAT — MITRE ATT&CK describes Proton as a macOS backdoor focused on data theft and cred...
Ransomware — EvilQuest, also named ThiefQuest, was found in 2020 in trojanized pirated Mac ap...
Trojan — Jamf Threat Labs described RustBucket in April 2023 and suspects a North Korean ...
System Settings › Privacy & Security › Screen & System Audio Recording (called Screen Recording on macOS 13)
System Settings › Privacy & Security › Full Disk Access
System Settings › Privacy & Security › Accessibility (on macOS 27, some developers' guides call this pane Device Control and Data Access)
Eleanor is a macOS backdoor hidden in EasyDoc Converter, which claimed to convert documents but didn't. Instead it installed a Tor hidden service, a local PHP control panel and a Pastebin agent, letting attackers reach the Mac anonymously to manage files, run commands and use the webcam.
Check whether EasyDoc Converter is installed, and look in Activity Monitor for tor, php or httpd processes you didn't start. Then check your launch items for anything added when you installed it.
A Tor hidden service gives each Mac an address reachable only through the Tor network, which hides where the attacker is connecting from. The Pastebin agent is how the attacker learned each Mac's address.
Bitdefender found it used the open-source wacaw tool to capture images and video. Apple says the camera can't activate without the green indicator light turning on, so the light is your cue; disconnect from the internet and follow the removal steps.
Free, with no account: the scan checks your Downloads folder against a built-in malware-hash list and 19 YARA rules.
Apple silicon build 2.0.7 · Intel Mac?
For your Mac, not this phone ·
Count which apps can record your screen, use your mic or camera, or read your files, and get a free 0–100 estimate in your browser.
Estimate your Security ScoreFree · Calculated in your browser