Loading malware…
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The AppleScript was used against a victim in August 2023, and fetched from a fake domain support.video-meeting[.]online, which shared its resolved IP address (104.168.214[.]151) with the ObjCShellZ malware’s C2 server swissborg[.]blog.
other campaigns have leveraged malware families like KANDYKORN, ObjCShellz, and TodoSwift.
5 distinct techniques documented for this family, organized by ATT&CK tactic.
It then uses chmod 0x777 to set the permissions of the file to world read, write and execute, and finally executes it via popen.
4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as a malware family leveraged in related BlueNoroff macOS-targeting campaigns; no additional technical behavior is described in this content.
A payload from a previous related campaign whose function naming overlaps with the current malware.
An Objective-C macOS backdoor/late-stage payload that executes shell commands received from a remote C2 using sh -c.
A malware family referenced through infrastructure overlap with BlueNoroff activity; its C2 infrastructure shared an IP with a fake domain used in the GhostCall campaign.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.