Record · corpus.blog/posts/01a0b68a-1f9a-7243-aa5e-729872444a82

The Mac Malware of 2024

objective-see.org · published 1 January 2025

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at objective-see.org Wayback capture

1blogs citing

First cited: 4 Feb 2025
Most recent: 4 Feb 2025
Rank this month: not ranked
External links: 149
Words captured: 23,492

Cited by

Blog

In the post

Date

Unit 42

Stealers on the Rise: A Closer Look at a Growing macOS Threat Read at the source ↗

4 Feb 2025

Links from this post

Link

Host

https://objective-see.com/malware.html

objective-see.com

https://moonlock.com/moonlock-2024-macos-threat-report

moonlock.com

https://www.computerworld.com/article/3679730/jamf-q3-data-confirms-rapid-mac-adoption-across-the-enterprise.html

computerworld.com

https://objective-see.com/products/utilities.html

objective-see.com

https://objective-see.com/products/whatsyoursign.html

objective-see.com

https://objective-see.com/products/netiquette.html

objective-see.com

https://mothersruin.com/software/SuspiciousPackage/

mothersruin.com

https://www.hopperapp.com/

hopperapp.com

https://github.com/objective-see/Malware/raw/main/CloudChat.zip

github.com

https://x.com/AdamJKohler/

x.com

https://x.com/L0Psec

x.com

https://www.kandji.io/blog/cloudchat-infostealer

kandji.io

https://twitter.com/hashtag/cybersecurity?src=hash&ref_src=twsrc%5Etfw

twitter.com

https://twitter.com/hashtag/malware?src=hash&ref_src=twsrc%5Etfw

twitter.com

https://twitter.com/hashtag/infostealer?src=hash&ref_src=twsrc%5Etfw

twitter.com

https://twitter.com/hashtag/cryptostealer?src=hash&ref_src=twsrc%5Etfw

twitter.com

https://twitter.com/hashtag/cloudchat?src=hash&ref_src=twsrc%5Etfw

twitter.com

https://twitter.com/hashtag/reverseengineering?src=hash&ref_src=twsrc%5Etfw

twitter.com

https://twitter.com/hashtag/kandji?src=hash&ref_src=twsrc%5Etfw

twitter.com

https://twitter.com/hashtag/edr?src=hash&ref_src=twsrc%5Etfw

twitter.com

https://twitter.com/hashtag/mdm?src=hash&ref_src=twsrc%5Etfw

twitter.com

https://twitter.com/AdamJKohler/status/1777429179648143667?ref_src=twsrc%5Etfw

twitter.com

https://alden.io/posts/cloudchat-returns/

alden.io

https://www.malwarebytes.com/blog/news/2024/03/malicious-meeting-invite-fix-targets-mac-users

malwarebytes.com

https://github.com/atotto/clipboard

github.com

https://github.com/objective-see/Malware/raw/main/Poseidon.zip

github.com

https://twitter.com/hashtag/stealer?src=hash&ref_src=twsrc%5Etfw

twitter.com

https://twitter.com/hashtag/macOS?src=hash&ref_src=twsrc%5Etfw

twitter.com

https://t.co/GWj0usUC1x

t.co

https://twitter.com/moonlock_lab/status/1793701690094620719?ref_src=twsrc%5Etfw

twitter.com

https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-poseidon-a0e8880af071

g0njxa.medium.com

https://www.sentinelone.com/blog/from-amos-to-poseidon-a-soc-teams-guide-to-detecting-macos-atomic-stealers-2024/

sentinelone.com

https://www.malwarebytes.com/blog/news/2024/06/poseidon-mac-stealer-distributed-via-google-ads

malwarebytes.com

https://github.com/objective-see/Malware/raw/main/Cthulhu.zip

github.com

https://twitter.com/CadoSecurity/status/1826575059181289912?ref_src=twsrc%5Etfw

twitter.com

https://www.cadosecurity.com/blog/from-the-depths-analyzing-the-cthulhu-stealer-malware-for-macos

cadosecurity.com

https://www.pcmag.com/news/macos-malware-mimicked-popular-apps-to-steal-passwords-crypto-wallets

pcmag.com

https://github.com/n0fate/chainbreaker

github.com

https://github.com/objective-see/Malware/raw/main/BeaverTail.zip

github.com

https://x.com/malwrhunterteam/

x.com

https://t.co/YRIMLPl5r8

t.co

https://twitter.com/malwrhunterteam/status/1812792291876119034?ref_src=twsrc%5Etfw

twitter.com

https://www.virustotal.com/gui/file/9abf6b93eafb797a3556bea1fe8a3b7311d2864d5a9a3687fce84bc1ec4a428c

virustotal.com

Hacking Employers and Seeking Employment: Two Job-Related Campaigns Bear Hallmarks of North Korean Threat Actors Read at the source ↗

unit42.paloaltonetworks.com

https://www.virustotal.com/gui/ip-address/95.164.17.24/relations

virustotal.com

https://github.com/objective-see/Malware/raw/main/PyStealer.zip

github.com

https://twitter.com/hashtag/macos?src=hash&ref_src=twsrc%5Etfw

twitter.com

https://t.co/549PS392CP

t.co

https://twitter.com/moonlock_lab/status/1762445495664787941?ref_src=twsrc%5Etfw

twitter.com

https://x.com/moonlock_lab/status/1762445495664787941

x.com

https://github.com/extremecoders-re/pyinstxtractor

github.com

https://pylingual.io

pylingual.io

https://github.com/objective-see/Malware/raw/main/Banshee.zip

github.com

https://t.co/jj4zl0rtUG

t.co

https://twitter.com/privacyis1st/status/1822948909670408573?ref_src=twsrc%5Etfw

twitter.com

https://www.elastic.co/security-labs/beyond-the-wail

elastic.co

https://github.com/vxunderground/MalwareSourceCode/blob/main/MacOS/MacOS.Stealer.Banshee.7z!

github.com

https://github.com/objective-see/Malware/raw/main/NotLockBit.zip

github.com

https://www.trendmicro.com/en_us/research/24/j/fake-lockbit-real-damage-ransomware-samples-abuse-aws-s3-to-stea.html

trendmicro.com

https://www.sentinelone.com/blog/macos-notlockbit-evolving-ransomware-samples-suggest-a-threat-actor-sharpening-its-tools/

sentinelone.com

https://github.com/objective-see/Malware/raw/main/SpectralBlur.zip

github.com

https://twitter.com/greglesnewich

twitter.com

https://twitter.com/hashtag/100DaysofYARA?src=hash&ref_src=twsrc%5Etfw

twitter.com

https://t.co/Y8U3hsjNiF

t.co

https://twitter.com/greglesnewich/status/1742575613834084684?ref_src=twsrc%5Etfw

twitter.com

https://g-les.github.io/yara/2024/01/03/100DaysofYARA_SpectralBlur.html

g-les.github.io

https://github.com/objective-see/Malware/raw/main/ZuRu.zip

github.com

https://twitter.com/malwrhunterteam/

twitter.com

https://t.co/bZortngn9c

t.co

https://twitter.com/malwrhunterteam/status/1745959438140297697?ref_src=twsrc%5Etfw

twitter.com

https://www.jamf.com/blog/jtl-malware-pirated-applications/

jamf.com

https://www.virustotal.com/gui/file/1b2d50cdacfd39205c3caff2925eb35b59312dbe099bd3a98ae3b2f2f909ab17

virustotal.com

https://www.virustotal.com/gui/file/21457a89317e4c6b8aaee5e461a6b4e444c736243d550efd0e681eda05b97007

virustotal.com

iOS exploit chain deploys LightSpy feature-rich malware Read at the source ↗

securelist.com

https://github.com/objective-see/Malware/raw/main/LightSpy.zip

github.com

https://x.com/dimitribest/status/1778181862696915233

x.com

https://twitter.com/BlackBerry/status/1778924839014719546?ref_src=twsrc%5Etfw

twitter.com

https://www.huntress.com/blog/lightspy-malware-variant-targeting-macos

huntress.com

https://blogs.blackberry.com/en/2024/04/lightspy-returns-renewed-espionage-campaign-targets-southern-asia-possibly-india

blogs.blackberry.com

https://github.com/objective-see/Malware/raw/main/HZ_RAT.zip

github.com

HZ Rat backdoor for macOS attacks users of China’s DingTalk and WeChat Read at the source ↗

securelist.com

https://t.co/Bfe0n4mxrf

t.co

https://twitter.com/e_kaspersky/status/1828713486056096188?ref_src=twsrc%5Etfw

twitter.com

https://github.com/objective-see/Malware/raw/main/Activator.zip

github.com

Cracked software beats gold: new macOS backdoor stealing cryptowallets Read at the source ↗

securelist.com

https://twitter.com/kaspersky/status/1759805130776412315?ref_src=twsrc%5Etfw

twitter.com

https://www.sentinelone.com/blog/backdoor-activator-malware-running-rife-through-torrents-of-macos-apps/

sentinelone.com

https://developer.apple.com/news/?id=saqachfa

developer.apple.com

https://twitter.com/defcon?ref_src=twsrc%5Etfw

twitter.com

https://twitter.com/patrickwardle/status/1765468165113561312?ref_src=twsrc%5Etfw

twitter.com

https://github.com/objective-see/Malware/raw/main/HiddenRisk.zip

github.com

https://www.sentinelone.com/labs/bluenoroff-hidden-risk-threat-actor-targets-macs-with-fake-crypto-news-and-novel-persistence/

sentinelone.com

https://twitter.com/LabsSentinel/status/1854550940243702083?ref_src=twsrc%5Etfw

twitter.com

https://github.com/objective-see/Malware/raw/main/RustDoor.zip

github.com

https://twitter.com/Bitdefender/status/1759925875917857092?ref_src=twsrc%5Etfw

twitter.com

https://www.jamf.com/blog/jamf-threat-labs-observes-targeted-attacks-amid-fbi-warnings/

jamf.com

https://www.bitdefender.com/en-us/blog/labs/new-macos-backdoor-written-in-rust-shows-possible-link-with-windows-ransomware-group

bitdefender.com

https://github.com/objective-see/Malware/raw/main/RustyAttr.zip

github.com

https://www.group-ib.com

group-ib.com

https://twitter.com/hashtag/Lazarus?src=hash&ref_src=twsrc%5Etfw

twitter.com

https://t.co/qZTRbZPJKV

t.co

https://twitter.com/GroupIB_TI/status/1856577490887549315?ref_src=twsrc%5Etfw

twitter.com

https://twitter.com/malwarezoo?ref_src=twsrc%5Etfw

twitter.com

https://twitter.com/jbradley89?ref_src=twsrc%5Etfw

twitter.com

https://t.co/fzc7Vyn4lS

t.co

https://twitter.com/virusbtn/status/1856628202665300467?ref_src=twsrc%5Etfw

twitter.com

https://www.jamf.com/blog/jamf-threat-labs-apt-actors-embed-malware-within-macos-flutter-applications/

jamf.com

https://twitter.com/hashtag/vshell?src=hash&ref_src=twsrc%5Etfw

twitter.com

https://t.co/hhuelPCPLU

t.co

https://twitter.com/AzakaSekai_/status/1846196267346808850?ref_src=twsrc%5Etfw

twitter.com

https://www.kandji.io/blog/fake-cloudflare-authenticator

kandji.io

https://github.com/objective-see/Malware/raw/main/EvasivePanda.zip

github.com

https://twitter.com/TonyAtESET?ref_src=twsrc%5Etfw

twitter.com

https://twitter.com/hashtag/Cybersecurity?src=hash&ref_src=twsrc%5Etfw

twitter.com

https://twitter.com/hashtag/ESETResearch?src=hash&ref_src=twsrc%5Etfw

twitter.com

https://t.co/1bGmtsuyeW

t.co

https://twitter.com/ESET/status/1766132133662273854?ref_src=twsrc%5Etfw

twitter.com

https://www.welivesecurity.com/en/eset-research/evasive-panda-leverages-monlam-festival-target-tibetans/

welivesecurity.com

https://github.com/objective-see/Malware/raw/main/SnowLight.zip

github.com

https://twitter.com/cyb3rops/status/1785596841452589059?ref_src=twsrc%5Etfw

twitter.com

https://cloud.google.com/blog/topics/threat-intelligence/initial-access-brokers-exploit-f5-screenconnect

cloud.google.com

https://github.com/objective-see/Malware/raw/main/InletDrift.zip

github.com

https://medium.com/@RadiantCapital/radiant-capital-incident-update-e56d8c23829e

medium.com

https://therecord.media/radiant-capital-heist-north-korea

therecord.media

https://github.com/objective-see/Malware/raw/main/ToDoSwift.zip

github.com

https://twitter.com/L0Psec/status/1824585197423300725?ref_src=twsrc%5Etfw

twitter.com

https://www.kandji.io/blog/todoswift-disguises-malware-download-behind-bitcoin-pdf

kandji.io

https://thehackernews.com/2024/08/new-macos-malware-todoswift-linked-to.html

thehackernews.com

https://t.co/H9gEFvuCHb

t.co

https://twitter.com/moonlock_lab/status/1869458400003883243?ref_src=twsrc%5Etfw

twitter.com

https://9to5mac.com/2024/11/28/security-bite-mosyle-identifies-new-malware-loaders-written-in-unconventional-languages-exclusive/

9to5mac.com

https://t.co/aKzr7yXFRp

t.co

https://twitter.com/moonlock_lab/status/1869458418148524366?ref_src=twsrc%5Etfw

twitter.com

https://x.com/victorkubashok/

x.com

https://twitter.com/hashtag/Bar1?src=hash&ref_src=twsrc%5Etfw

twitter.com

https://t.co/28WCb1mdmv

t.co

https://twitter.com/victorkubashok/status/1787852808697294871?ref_src=twsrc%5Etfw

twitter.com

https://www.intego.com/mac-security-blog/intego-discovers-new-atomic-stealer-amos-mac-malware-variants/

intego.com

https://t.co/nHNBuUyC0y

t.co

https://t.co/nJCt6RnUfG

t.co

https://t.co/TmKsHAwDo3

t.co

https://t.co/P2TGw98UR6

t.co

https://github.com/geemion/Khepri

github.com

https://t.co/fj50AsBPcR

t.co

https://t.co/jdbXPmh8sW

t.co

https://t.co/dHjsETM4Ko

t.co

https://t.co/Tdz1Hvy40l

t.co

https://t.co/LgX8x5rrFe

t.co

https://t.co/97Re0MY7VO

t.co

Elsewhere on objective-see.org (12)

https://objective-see.org/downloads/MacMalware_2024.pdf

objective-see.org

This Meeting Should Have Been an Email Read at the source ↗

objective-see.org

The Mac Malware of 2023 Read at the source ↗

objective-see.org

Analyzing DPRK's SpectralBlur Read at the source ↗

objective-see.org

https://objective-see.org/products/utilities.html

objective-see.org

Why Join The Navy If You Can Be A Pirate? Read at the source ↗

objective-see.org

https://objective-see.org/downloads/blog/blog_0x7D/Dprk_Downloader.zip

objective-see.org

https://objective-see.org/downloads/blog/blog_0x7D/Vshell_Downloader.zip

objective-see.org

https://objective-see.org/products/lulu.html

objective-see.org

https://objective-see.org/downloads/blog/blog_0x7D/Unnamed_Downloader.zip

objective-see.org

https://objective-see.org/tools.html

objective-see.org

https://objective-see.org/products/blockblock.html

objective-see.org