Loading malware…
MacMa, also known as CDDS and OSX.CDDS, is a macOS cyber-espionage backdoor. It supports host and device fingerprinting, username collection, keylogging, arbitrary command execution, screen capture, microphone recording, and bidirectional file transfer. Collected files may be staged locally and exfiltrated through its command-and-control channel, which uses TLS to initialize a custom protocol. MacMa can establish persistence through a LaunchAgent configured to execute at user login, and can modify file timestamps to hinder forensic analysis. It has been delivered to macOS targets through compromised software-update workflows, including campaigns that redirected insecure HTTP update requests to malicious installers without user interaction. StormBamboo, also known as Evasive Panda, deployed MacMa against organizations in Asia in such an operation. MacMa is distinct from the separate DazzleSpy macOS malware family despite reported operational overlaps between their campaigns.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
This led to the in-memory execution of native Mac code, which exploits CVE-2021-30869 to gain root privileges. With this high level of privileges, the malware drops its payload onto the machine. | DazzleSpy, a piece of malware that attacks macOS, was discovered last fall by researchers at ESET... The new malware got a foothold via CVE-2021-1789... exploits CVE-2021-30869 to gain root privileges... That payload is a very full-featured backdoor, providing the attacker the capability to run any arbitrary command on the infected Mac, start a remote screen viewing session, download files from the Mac, steal the keychain, send synthetic mouse clicks, etc.
DazzleSpy, a piece of malware that attacks macOS, was discovered last fall by researchers at ESET... The new malware got a foothold via CVE-2021-1789... exploits CVE-2021-30869 to gain root privileges... That payload is a very full-featured backdoor, providing the attacker the capability to run any arbitrary command on the infected Mac, start a remote screen viewing session, download files from the Mac, steal the keychain, send synthetic mouse clicks, etc. | The new malware got a foothold via CVE-2021-1789, exploited via a JavaScript file named mac.js loaded by the malicious site. This led to the in-memory execution of native Mac code, which exploits CVE-2021-30869 to gain root privileges.
keychain: Dumps the keychain using a CVE-2019-8526 exploit if the macOS version is lower than 10.14.4. The public KeySteal implementation is used.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
MACMA is able to perform device fingerprinting, keylogging, executing commands, screen and audio capture, and uploading/downloading files.
Google labelled the backdoor “Macma”… Objective-See (under the name “OSX.CDDS”)… we take a deeper dive into macOS.Macma…
31 distinct techniques documented for this family, organized by ATT&CK tactic.
It infected machines using a combination of two vulnerabilities, one in WebKit (the framework that powers Safari) and one in macOS (a privilege escalation vulnerability). | DazzleSpy, according to the researchers at ESET, was being spread via watering hole attacks via pro-democracy websites in China.
Bundlore can persist via a LaunchAgent. Calisto adds a .plist file to the /Library/LaunchAgents folder to maintain persistence. CoinTicker creates user launch agents named .espl.plist and com.apple.[random string].plist to establish persistence.
The attacker-controlled server hosted a malicious installer, and the installer eventually downloaded either MGBot malware for Windows or MACMA for macOS.
The items you’re most likely to see are: /var/root/Library/LaunchAgents/com.apple.softwareupdate.plist ... However, it’s also possible the malware could get dropped into the user folder, in which case you’ll see these paths instead: ~/Library/LaunchAgents/com.apple.softwareupdate.plist
This led to the in-memory execution of native Mac code, which exploits CVE-2021-30869 to gain root privileges.
Bundlore can persist via a LaunchAgent. Calisto adds a .plist file to the /Library/LaunchAgents folder to maintain persistence. CoinTicker creates user launch agents named .espl.plist and com.apple.[random string].plist to establish persistence.
The attacker-controlled server hosted a malicious installer, and the installer eventually downloaded either MGBot malware for Windows or MACMA for macOS.
The items you’re most likely to see are: /var/root/Library/LaunchAgents/com.apple.softwareupdate.plist ... However, it’s also possible the malware could get dropped into the user folder, in which case you’ll see these paths instead: ~/Library/LaunchAgents/com.apple.softwareupdate.plist
Green Lambert can create a Launch Agent with the RunAtLoad key-value pair set to true, ensuring the com.apple.GrowlHelper.plist file runs every time a user logs in. Komplex creates a persistent launch agent called ... com.apple.updates.plist. MacMa installs a com.apple.softwareupdate.plist file in the /LaunchAgents folder.
method.MethodClass.clearTrace Uses NSFileManager’s removeItemAtPath to clear various logs
APT28 has performed timestomping on victim files. APT29 has used timestomping to alter the Standard Information timestamps on their web shells to match other files in the same directory. APT32 has used scheduled task raw XML with a backdated timestamp... APT38 has modified data timestamps to mimic files that are in the same folder on a compromised host.
The content repeatedly describes threat actors and malware using valid, stolen, forged, self-signed, or abused code-signing certificates to sign malware and appear legitimate, including examples such as AppleJeus using a valid digital signature from Sectigo, APT41 leveraging code-signing certificates, FIN7 signing Carbanak payloads, and SUNBURST being digitally signed by SolarWinds.
That payload is a very full-featured backdoor, providing the attacker the capability to... send synthetic mouse clicks...
MgBOT ... enables ... keylogging and password dumping. MACMA is able to perform device fingerprinting, keylogging, executing commands, screen and audio capture.
Browser cookies and data are encoded with base64 and exfiltrated to a Google Drive using AES encryption.
The content repeatedly describes malware and threat actors using commands and APIs such as ipconfig /all, ifconfig, arp -a, route print, nbtstat, netsh, GetAdaptersInfo, and GetIpNetTable to gather IP addresses, MAC addresses, DNS, DHCP, gateways, routing tables, ARP cache, proxy settings, domains, and network adapter/interface details.
The content repeatedly describes malware and threat actors collecting the username, identifying the current user, enumerating logged-on users, or running commands such as whoami, query user, and quser to determine user context on compromised systems.
Tasklist can be used to discover processes running on a system. Numerous malware families and threat groups are described as listing running processes, enumerating PIDs, checking for specific process names, or using APIs such as CreateToolhelp32Snapshot and commands such as tasklist and ps.
The content repeatedly describes malware and threat actors collecting host details such as hostname, OS version, architecture, CPU, memory, BIOS, language, and other machine characteristics; e.g., "Action RAT has the ability to collect the hostname, OS version, and OS architecture of an infected host."
Multiple entries describe enumerating local, logical, or physical drives and disk/volume information, e.g., 'can enumerate local drives,' 'GetLogicalDrives,' 'fsutil fsinfo drives,' 'list drives,' and 'discover logical drive information including the drive type, free space, and volume information.'
That payload is a very full-featured backdoor, providing the attacker the capability to... download files from the Mac...
That payload is a very full-featured backdoor, providing the attacker the capability to... send synthetic mouse clicks...
MgBOT ... enables ... keylogging and password dumping. MACMA is able to perform device fingerprinting, keylogging, executing commands, screen and audio capture.
The attacker redirects the HTTP request to a Command and Control (C2) server they control hosting a forged text file and a malicious installer.
32 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
45 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
MACMA is a backdoor malware for Apple macOS, distributed via watering hole attacks by Evasive Panda. Details on its specific capabilities are not provided in this content.
A macOS implant referenced as Evasive Panda’s macOS counterpart to MgBot; mentioned in the context of tailoring payload delivery based on OS version.
... MacMa ... (v2.0→v2.1) ...
MacMa (v2.0→v2.1)
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.