Skip to main content
Live Webinar with SANS (June 25)— Agentic CTI Automation for Fun & ProfitRegister Free
Mallory
MalwareUsed by 2 actors

Mach-O Man

Share:
For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

THREAT ACTORS

Groups observed using it

2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details
Lazarus

Lazarus Group is abusing “ClickFix” social engineering to push a new macOS malware kit dubbed “Mach-O Man,” giving attackers a direct path to credentials, Keychain secrets, and corporate access in fintech and crypto environments.

via gbhackersgbhackers.com
Contagious Interview

So, for the lack of a better name, we’re calling this new kit Mach-O Man.

via quetzal bitso blogquetzal.bitso.com
MITRE ATT&CK

Techniques & procedures

25 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques
T1566PhishingEvidence2

Victims are redirected to convincing phishing sites that imitate Zoom, Microsoft Teams, or Google Meet and claim there is a connection issue that must be fixed manually.

T1566.002Spearphishing LinkEvidence2

Attacks commenced with the delivery of urgent meeting invites purportedly from business contacts or colleagues that include links diverting to fake Microsoft Teams, Zoom, or Google Meet websites

Execution

2 techniques
T1059.004Unix ShellEvidence4

the page instructs the user to copy and paste a Terminal command... it immediately downloads and launches the first Mach-O payload.

T1204User ExecutionEvidence2

display a connection issue, which requires command execution in Terminal to be resolved

Persistence

3 techniques
T1543.001Launch AgentEvidence1

It then creates a LaunchAgent, roughly the macOS equivalent of Windows Services, to maintain persistence by executing OneDrive, which in turn instantiates the previous components on startup.

T1547Boot or Logon Autostart ExecutionEvidence2

Subsequent components, such as minst2.bin, establish persistence by dropping a disguised binary ... and registering it as a LaunchAgent to run at every login.

T1547.015Login ItemsEvidence2

registering it as a LaunchAgent to run at every login.

Privilege Escalation

3 techniques
T1543.001Launch AgentEvidence1

It then creates a LaunchAgent, roughly the macOS equivalent of Windows Services, to maintain persistence by executing OneDrive, which in turn instantiates the previous components on startup.

T1547Boot or Logon Autostart ExecutionEvidence2

Subsequent components, such as minst2.bin, establish persistence by dropping a disguised binary ... and registering it as a LaunchAgent to run at every login.

T1547.015Login ItemsEvidence2

registering it as a LaunchAgent to run at every login.

Stealth

2 techniques
T1036MasqueradingEvidence3

dropping a disguised binary (for example, masquerading as OneDrive) under an “Antivirus Service” folder

T1070.004File DeletionEvidence1

A self-deletion script ( delete_self.sh ) then wipes all components using the native rm command.

Defense Impairment

1 technique
T1553.002Code SigningEvidence2

The malware uses the macOS codesign utility to apply ad-hoc signatures, helping the apps appear legitimate enough to run under standard execution policies.

Credential Access

3 techniques
T1056Input CaptureEvidence1

Stage 1 – The Stager ( teamsSDK.bin ) ... prompts the victim for their password three times, with the window shaking on first two attempts to simulate authentication failure before silently accepting credentials.

T1539Steal Web Session CookieEvidence3

It targets browser-stored credentials and cookies, macOS Keychain entries, and other files that can grant access to SaaS platforms

T1555Credentials from Password StoresEvidence4

It targets browser-stored credentials and cookies, macOS Keychain entries

Discovery

5 techniques
T1016System Network Configuration DiscoveryEvidence2

a secondary module facilitates system profiling to obtain ... network configuration data

T1057Process DiscoveryEvidence2

collecting host identifiers, OS details, network configuration, processes, and browser extension data

T1082System Information DiscoveryEvidence4

a second module (variants such as D1YrHRTg.bin) profiles the system via sysctl and local tools, collecting host identifiers, OS details, network configuration, processes, and browser extension data

T1083File and Directory DiscoveryEvidence1

Stage 4 – The Stealer ( macrasv2 ): Harvests browser credentials, session cookies, SQLite-stored data, and macOS Keychain entries

T1217Browser Information DiscoveryEvidence2

Stage 2 – The Profiler ... collects ... a full inventory of installed browser extensions across Chrome, Firefox, Safari, Brave, Opera, and Vivaldi.

Collection

3 techniques
T1005Data from Local SystemEvidence1

A payload called macrasv2 is downloaded next, acting as stealer targeting browser extension data, stored browser credentials and cookies, macOS Keychain entries, and other files of interest

T1056Input CaptureEvidence1

Stage 1 – The Stager ( teamsSDK.bin ) ... prompts the victim for their password three times, with the window shaking on first two attempts to simulate authentication failure before silently accepting credentials.

T1560Archive Collected DataEvidence2

then compresses them into an archive such as user_ext.zip.

Command and Control

2 techniques
T1071.001Web ProtocolsEvidence2

Registers the host with the C2 server ... exfiltrates it via the Telegram Bot API — a trusted channel that blends into normal traffic.

T1105Ingress Tool TransferEvidence1

Running the command launches the initial staging binary that retrieves bogus macOS apps

Exfiltration

2 techniques
T1041Exfiltration Over C2 ChannelEvidence1

Researchers note that parts of the kit are poorly written, with some profilers entering infinite loops that continuously POST the same data to command-and-control servers... The final stealer stage... aggregates high-value data from the system before exfiltration.

T1567Exfiltration Over Web ServiceEvidence2

Stage 4 – The Stealer ( macrasv2 ) ... exfiltrates it via the Telegram Bot API — a trusted channel that blends into normal traffic.

Other

1 technique
T1656ImpersonationEvidence1

The attack begins not with a software exploit, but with a deceptively simple social engineering technique known as ClickFix. Victims ... receive an urgent Telegram message from a compromised or impersonated contact, containing what appears to be a legitimate invitation to a Zoom, Microsoft Teams, or Google Meet session.

INDICATORS OF COMPROMISE

IOCs tracked for this family

3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app
Network
3 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting
domain●●●●●●●●●●●●View more in app2 months ago
domain●●●●●●●●●●●●View more in app2 months ago
domain●●●●●●●●●●●●View more in app2 months ago
ACTIVITY FEED

Recent activity

4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

scworldNews
May 1, 2026
New Mach-O Man malware tapped by Lazarus in macOS-targeted ClickFix attacks | brief | SC Media

A macOS-focused malware kit used in a ClickFix campaign. It delivers an initial staging binary, retrieves fake macOS apps for credential theft, performs system profiling, and ultimately deploys a stealer component to exfiltrate credentials, cookies, Keychain secrets, and other files.

Read more
cyber security newsNews
Apr 29, 2026
Mach-O Man macOS Malware Targets Crypto and Fintech Users

A modular macOS malware kit built in Go as native Mach-O binaries for Intel and Apple Silicon systems. It uses ClickFix-style social engineering and fake meeting apps to deploy a four-stage chain that profiles the host, establishes persistence, steals browser and Keychain data, and exfiltrates collected information via the Telegram Bot API.

Read more
gbhackersNews
Apr 29, 2026
Lazarus Targets macOS Users With New “Mach-O Man” Malware Kit

A modular macOS malware kit delivered via ClickFix-style social engineering. It uses a stager to fetch fake conferencing or system apps, profiles the host, steals browser credentials and cookies, extracts macOS Keychain data and other files, exfiltrates them in archives, and can establish persistence via LaunchAgents.

Read more
quetzal bitso blogNews
Apr 13, 2026
North Korea's Safari: Hunting for RATs - by Mauro Eldritch

A macOS malware kit used by Famous Chollima/Lazarus-linked operators. It is delivered via ClickFix lures on fake meeting sites, deploys Mach-O binaries, steals credentials and browser data, profiles infected hosts, establishes persistence via LaunchAgent, and exfiltrates data including browser credentials, cookies, extension data, and Keychain entries via Telegram and C2 infrastructure.

Read more
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.
IOC matching3

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution2

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping25

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.