Malware

iKitten

Also known asOSX/MacDownloader

iKitten, also known as OSX/MacDownloader, is a macOS credential-stealing malware family associated with surveillance-oriented activity. It targets Apple systems and combines host reconnaissance, credential harvesting, defense evasion, and data theft. Observed behavior includes enumerating running processes, determining the victim system’s IP address, prompting the user for credentials through deceptive interaction, and collecting sensitive local data for exfiltration. It has also been documented compressing keychain material prior to theft, indicating a focus on obtaining stored secrets and authentication data from compromised Macs. For stealth, iKitten stores itself using a dot-prefixed name so it remains hidden from users by default in standard macOS views. The malware’s tradecraft is consistent with post-compromise collection and exfiltration on macOS endpoints, particularly where access to user credentials and keychain contents is operationally valuable.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

8 distinct techniques documented for this family, organized by ATT&CK tactic.

Persistence

1 technique

T1037.004RC ScriptsEvidence1

Privilege Escalation

1 technique

T1037.004RC ScriptsEvidence1

Stealth

1 technique

T1564.001Hidden Files and DirectoriesEvidence3

The content repeatedly describes malware and threat actors creating hidden folders, adding dot prefixes to filenames, and setting file attributes such as hidden/system to conceal files and directories from users and defenders.

Credential Access

2 techniques

T1056.002GUI Input CaptureEvidence2

Bundlore prompts the user for their credentials. Calisto presents an input prompt asking for the user's login and password. Cuckoo Stealer has captured passwords by prompting victims with a "macOS needs to access System Settings" GUI window. Dok prompts the user for credentials. FIN4 has presented victims with spoofed Windows Authentication prompts to collect their credentials. iKitten prompts the user for their credentials. Keydnap prompts the users for credentials. Proton prompts users for their credentials. RedCurl prompts the user for credentials through a Microsoft Outlook pop-up. SILENTTRINITY's credphisher.py module can prompt a current user for their credentials. XCSSET prompts the user to input credentials using a native macOS dialog box leveraging the system process /Applications/Safari.app/Contents/MacOS/SafariForWebKitDevelopment.

T1555.001KeychainEvidence1

Discovery

2 techniques

T1016System Network Configuration DiscoveryEvidence5

AdFind can extract subnet information from Active Directory; actors used ipconfig /all after exploiting a machine; numerous malware and groups used ipconfig, ifconfig, arp, route, netsh, nbtstat, NBTscan, and related APIs to gather IP, MAC, DNS, DHCP, gateway, proxy, domain, ARP cache, routing, and adapter details.

T1057Process DiscoveryEvidence5

Tasklist can be used to discover processes running on a system. Numerous malware families and threat groups are described as listing running processes, collecting PIDs, checking for specific process names, or enumerating loaded modules.

Collection

3 techniques

T1056.002GUI Input CaptureEvidence2

T1560Archive Collected DataEvidence1

Multiple actors and tools are described as using 7-Zip/WinRAR/zip/tar/gzip/makecab/PowerShell Compress-Archive to compress (often password-protect/encrypt) collected data prior to exfiltration (e.g., “used 7zip to archive extracted data in preparation for exfiltration”, “created password-protected RAR archives prior to exfiltration”, “used built-in PowerShell capabilities (Compress-Archive cmdlet) to compress collected data”).

T1560.001Archive via UtilityEvidence1

ACTIVITY FEED

Recent activity

9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

9 SOURCESView more in app

mitre attack websiteNews

Apr 25, 2022

System Network Configuration Discovery, Technique T1016 - Enterprise | MITRE ATT&CK®

Looks up the current IP address of infected systems.

mitre attack websiteNews

Oct 21, 2021

System Network Configuration Discovery, Technique T1016 - Enterprise | MITRE ATT&CK®

Backdoor that looks up the current IP address of the infected host.

mitre attack websiteNews

Oct 21, 2021

Process Discovery, Technique T1057 - Enterprise | MITRE ATT&CK®

Backdoor malware that lists currently running processes.

mitre attack websiteNews

Jul 3, 2017

Input Capture: GUI Input Capture, Sub-technique T1056.002 - Enterprise | MITRE ATT&CK®

Malware that prompts users for credentials for theft.

+5 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping8

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

iKitten

Also known asOSX/MacDownloader