Malware

CoinTicker

CoinTicker is a macOS malware family associated with cryptocurrency-themed activity. It has been documented using hidden, dot-prefixed artifacts and LaunchAgent-based persistence to reduce user visibility and maintain execution across logins. The malware stages concealed files in temporary and user-library locations, creates user LaunchAgents including masquerading names that resemble Apple components, and stores additional payload material in hidden container-style directories.

CoinTicker also uses OpenSSL to decode or decrypt an initially downloaded hidden encoded file as part of its execution chain, indicating staged payload handling and defense-evasion tradecraft. It has been observed using curl to retrieve secondary payloads, a delivery and execution pattern that can bypass some macOS trust controls when quarantine metadata is not applied. In addition, CoinTicker executes a bash script to establish a reverse shell, providing remote post-compromise access.

The malware targets macOS systems and combines hidden-file staging, shell-based execution, payload decoding, persistence, and remote shell functionality. Its observed behavior aligns with post-exploitation activity focused on stealthy foothold establishment and continued operator access on compromised Apple endpoints.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

10 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

4 techniques

T1059.003Windows Command ShellEvidence2

Numerous entries state malware can create a remote shell or reverse shell, for example 4H RAT, BLACKCOFFEE, DarkComet, PlugX, QuasarRAT, and others.

T1059.004Unix ShellEvidence4

The content includes Linux/Unix shell usage such as CoinTicker executing a bash script to establish a reverse shell and Darkhotel launching a shell script that downloads and executes a file.

T1059.006PythonEvidence1

T1204.002Malicious FileEvidence1

В терминологии MITRE ATT&CK задействованы User Execution: Malicious File (T1204.002, Execution ...).

Persistence

1 technique

T1543.001Launch AgentEvidence2

Bundlore can persist via a LaunchAgent. Calisto adds a .plist file to the /Library/LaunchAgents folder to maintain persistence. CoinTicker creates user launch agents named .espl.plist and com.apple.[random string].plist to establish persistence.

Privilege Escalation

1 technique

T1543.001Launch AgentEvidence2

Stealth

3 techniques

T1027Obfuscated Files or InformationEvidence4

The content repeatedly describes malware and threat actors using obfuscated code, encrypted strings, Base64/XOR/RC4/AES encoding, VMProtect/ConfuserEx/SmartAssembly, stack strings, control-flow flattening, opaque predicates, and hidden payloads to evade analysis and detection.

T1140Deobfuscate/Decode Files or InformationEvidence7

The content is a long ATT&CK-style listing of malware and threat groups that 'decrypt', 'decode', 'deobfuscate', 'unpack', or 'decompress' payloads, strings, configuration data, shellcode, and files prior to execution or use.

T1564.001Hidden Files and DirectoriesEvidence3

The content repeatedly describes malware and threat actors creating hidden folders, adding dot prefixes to filenames, and setting file attributes such as hidden/system to conceal files and directories from users and defenders.

Defense Impairment

1 technique

T1553.001Gatekeeper BypassEvidence2

В терминологии MITRE ATT&CK задействованы ... Gatekeeper Bypass (T1553.001, Defense Evasion ...).

Command and Control

1 technique

T1105Ingress Tool TransferEvidence2

The content repeatedly describes malware and threat actors that can "download files from C2," "download additional payloads," "upload and download files," "retrieve payloads from the C2 server," and "copy files to remote machines."

ACTIVITY FEED

Recent activity

9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

9 SOURCESView more in app

codebyNews

Jun 12, 2026

Обход защиты macOS Gatekeeper: red team техники

macOS malware family referenced as leveraging curl-based secondary payload delivery to evade Gatekeeper quarantine checks.

picus security blogNews

Feb 17, 2022

T1059 Command and Scripting Interpreter of the MITRE ATT&CK Framework

A macOS application that installs backdoors under the guise of a cryptocurrency ticker.

mitre attack websiteNews

Oct 21, 2021

Deobfuscate/Decode Files or Information, Technique T1140 - Enterprise | MITRE ATT&CK®

Malware that decodes an initially downloaded hidden encoded file using OpenSSL.

mitre attack websiteNews

Jan 1, 2021

Deobfuscate/Decode Files or Information, Technique T1140 - Enterprise | MITRE ATT&CK®

Malware that decodes an initially downloaded hidden encoded file using OpenSSL.

+5 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping10

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

CoinTicker