CHILLYHELL

ChillyHell is a modular macOS backdoor targeting Apple systems, particularly Intel-based Macs. It has been active since at least 2021 and was first publicly documented by Mandiant in 2023. The malware is written in C++ and has been linked to UNC4487, a threat cluster that Mandiant assessed as a suspected espionage actor and that was previously observed compromising Ukrainian government-related websites, including a Ukrainian auto insurance website used by government officials, to socially engineer victims into executing malware such as Matanbuchus or ChillyHell.

Once executed, ChillyHell profiles the compromised host, establishes persistence, and initiates command-and-control communications with hard-coded servers over HTTP or DNS. Reported C2 IPs include 93.88.75[.]252 and 148.72.172[.]53. Persistence mechanisms include LaunchAgent installation, LaunchDaemon installation, and shell profile injection or modification of .zshrc, .bash_profile, and .profile. The malware then enters a command loop and supports multiple post-compromise actions, including providing remote shell or command-line access, downloading updated versions of itself, fetching and dropping additional payloads, extracting local usernames, and conducting password brute-force activity. A referenced module, ModuleSUBF, enumerates user accounts from /etc/passwd and performs brute-force attacks using a password list retrieved from C2.

ChillyHell uses several evasion and stealth techniques. It timestomps created artifacts to make files appear older, including fallback use of shell touch commands if direct timestamp modification fails. It also changes or shifts its communication methods with control servers to avoid detection. Researchers reported that it can open a decoy Google.com page in the default browser to reduce user suspicion. The malware evaded detection for years, including a sample uploaded to VirusTotal on May 2, 2025 that reportedly had zero detections at the time referenced.

A notable aspect of ChillyHell is that malicious samples were developer-signed and passed Apple notarization in 2021, with one malicious file publicly hosted on Dropbox since 2021. Jamf reported renewed activity in 2025 and assessed the malware was still evolving. Apple later revoked the developer certificates associated with the malware after notification. The full scope of deployment is unknown, but reporting describes ChillyHell as used in targeted attacks and as likely the work of a cybercrime group, while other reporting ties it to UNC4487.