MalwareUsed by 2 actors

DEEPBREATH

DEEPBREATH is a Swift-based macOS data-mining malware used in UNC1069 intrusions, a financially motivated threat actor assessed to have a DPRK nexus and also tracked as CryptoCore and MASAN. It has been observed in targeted social-engineering campaigns against cryptocurrency and financial-sector victims, including intrusions initiated through fake Zoom meetings, Telegram outreach, and ClickFix-style command execution. DEEPBREATH is deployed as part of a broader macOS toolchain that has included WAVESHAPER, HYPERCALL, HIDDENCALL, SUGARLOADER, SILENCELIFT, and CHROMEPUSH.

Its core capability is bypassing macOS Transparency, Consent, and Control (TCC) protections by manipulating the user-specific TCC database rather than relying on user prompts. Reported behavior includes using Finder’s Full Disk Access to stage and modify TCC.db, injecting permissions to gain broad filesystem access to locations such as Desktop, Documents, and Downloads, restoring the modified database, and relaunching itself via AppleScript with the -autodata argument for background collection. With this access, DEEPBREATH steals data from login.keychain-db, browser cookies and login data from Google Chrome, Brave, and Microsoft Edge, local browser extension settings, Telegram data, and Apple Notes databases. Reporting also states it can steal iCloud Keychain credentials. Stolen data has been described as archived into ZIP files and exfiltrated using curl.

High-confidence associations in the content tie DEEPBREATH to UNC1069 operations targeting the cryptocurrency sector and individual victims for credential theft, browser/session theft, and broader host data collection to support financial theft and follow-on social engineering. Mentioned indicators and artifacts include the use of the -autodata argument and TCC database modification activity on macOS.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

APT38

Their tooling, including the WAVESHAPER backdoor, HYPERCALL downloader, DEEPBREATH data miner, and CHROMEPUSH browser extension stealer, was designed for deep, persistent compromise of individual machines.

via socket blogsocket.dev

Lazarus

...deploys a Swift-based data miner called DEEPBREATH. DEEPBREATH is equipped to manipulate macOS's Transparency, Consent, and Control (TCC) database... enabling it to steal iCloud Keychain credentials, and data from Google Chrome, Brave, and Microsoft Edge, Telegram, and the Apple Notes application.

via the hacker newsthehackernews.com

MITRE ATT&CK

Techniques & procedures

20 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1078Valid AccountsEvidence1

With that access, publishing a malicious package to npm requires no additional authentication bypass.

T1566.002Spearphishing LinkEvidence1

"The meeting link is designed to redirect the victim to a fake website masquerading as Zoom (\"zoom.uswe05[.]us\")." ... "using Telegram’s hyperlink feature to hide the phishing URLs."

Execution

2 techniques

T1204User ExecutionEvidence3

"...a social engineering scheme involving a compromised Telegram account, a fake Zoom meeting, a ClickFix infection vector, and reported usage of AI-generated video to deceive the victim."

T1204.002Malicious FileEvidence1

"trick the victim into running commands that installed multiple backdoors"

Persistence

2 techniques

T1078Valid AccountsEvidence1

With that access, publishing a malicious package to npm requires no additional authentication bypass.

T1556Modify Authentication ProcessEvidence1

Permission Injection: Once staged, the malware programmatically inserts permissions, effectively granting itself broad access to critical user folders like Desktop, Documents, and Downloads.

Privilege Escalation

2 techniques

T1078Valid AccountsEvidence1

With that access, publishing a malicious package to npm requires no additional authentication bypass.

T1548Abuse Elevation Control MechanismEvidence1

Instead of prompting the user for elevated permissions, DEEPBREATH directly manipulates the user's TCC database (TCC.db). It executes a series of steps to circumvent protections that prevent direct modification of the live database.

Stealth

2 techniques

T1078Valid AccountsEvidence1

With that access, publishing a malicious package to npm requires no additional authentication bypass.

T1216.002SyncAppvPublishingServerEvidence1

To ensure its operation remains uninterrupted, the malware uses an AppleScript to re-launch itself in the background using the -autodata argument, detaching from the initial process to continue data collection silently throughout the user's session.

Defense Impairment

1 technique

T1556Modify Authentication ProcessEvidence1

Permission Injection: Once staged, the malware programmatically inserts permissions, effectively granting itself broad access to critical user folders like Desktop, Documents, and Downloads.

Credential Access

5 techniques

T1539Steal Web Session CookieEvidence3

Browser Data: Copies cookies, login data, and local extension settings from major browsers including Google Chrome, Brave, and Microsoft Edge across all user profiles

T1555Credentials from Password StoresEvidence6

Credentials: Steals login credentials from the user keychain (login.keychain-db)

T1555.001KeychainEvidence2

"Credentials: Steals login credentials from the user keychain (login.keychain-db)"

T1555.003Credentials from Web BrowsersEvidence3

Browser Data: Copies cookies, login data, and local extension settings from major browsers including Google Chrome, Brave, and Microsoft Edge across all user profiles

T1556Modify Authentication ProcessEvidence1

Permission Injection: Once staged, the malware programmatically inserts permissions, effectively granting itself broad access to critical user folders like Desktop, Documents, and Downloads.

Discovery

1 technique

T1082System Information DiscoveryEvidence1

That action installs a remote access trojan that establishes persistence, collects system information, and calls home every 60 seconds awaiting further instructions.

Collection

4 techniques

T1005Data from Local SystemEvidence2

Messaging and Notes: Exfiltrates user data from two different versions of Telegram and also targets and copies database files from Apple Notes

T1213Data from Information RepositoriesEvidence2

“steal… Telegram databases, and Apple Notes content.”

T1560Archive Collected DataEvidence1

“The malware compresses all of the information into a ZIP archive...”

T1560.001Archive via UtilityEvidence1

“Stolen items were archived into ZIP files and exfiltrated using curl.”

Command and Control

1 technique

T1105Ingress Tool TransferEvidence2

"distribute a Go-based downloader codenamed HYPERCALL, which is then used to serve additional payloads" ... "SUGARLOADER ... used to deploy CHROMEPUSH"

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence2

“...and exfiltrates it to a remote server.”

Other

2 techniques

T1562.001Disable or Modify ToolsEvidence1

“DEEPBREATH… bypasses macOS TCC protections by modifying the TCC database to gain broad filesystem access”

T1656ImpersonationEvidence1

It was part of a coordinated, scalable attack pattern aimed at high-trust, high-impact open source maintainers.

ACTIVITY FEED

Recent activity

10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

10 SOURCESView more in app

socket blogNews

Apr 3, 2026

Attackers Are Hunting High-Impact Node.js Maintainers in a C...

A data-mining malware component used for deep, persistent compromise of individual machines.

polyswarmNews

Feb 20, 2026

UNC1069 Uses New Tools to Target Crypto Entities

Swift-based stealer that bypasses macOS TCC by staging/modifying the TCC database (leveraging Finder Full Disk Access) to access and steal Keychain credentials, browser artifacts (Chrome/Brave/Edge), Telegram databases, and Apple Notes; archives data to ZIP and exfiltrates via curl.

vulnuNews

Feb 13, 2026

🎓️ Vulnerable U | #155

Custom data-mining/stealer component used in a North Korea-linked attack to collect sensitive data (noted broadly as ‘vacuum up everything from browser data to Telegram messages and Apple Notes’) to enable immediate crypto theft and future impersonation.

the hacker newsNews

Feb 11, 2026

North Korea-Linked UNC1069 Uses AI Lures to Attack Cryptocurrency Organizations

Swift-based macOS data miner/stealer that manipulates TCC to expand file access and steals credentials and application/browser data (including iCloud Keychain, browsers, Telegram, Apple Notes).

+5 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution2

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping20

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

DEEPBREATH