Malware

chainbreaker

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

8 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1059Command and Scripting InterpreterEvidence1

Observed MITRE TTPs T1059 Command and Scripting Interpreter (osascript)

Credential Access

4 techniques

T1003OS Credential DumpingEvidence1

Chainbreaker can be used to extract the following types of information from an OSX keychain... Internet Passwords Generic Passwords Private Keys Public Keys X509 Certificates Secure Notes Appleshare Passwords... Given the keychain unlock password, a master key obtained using volafox or volatility, or an unlock file such as SystemKey, Chainbreaker will also provide plaintext passwords.

T1003.005Cached Domain CredentialsEvidence1

Dump items stored in an OSX Keychain... --dump-keychain-password-hash ... --dump-generic-passwords ... --dump-internet-passwords ... --unlock-file UNLOCK_FILE

T1555Credentials from Password StoresEvidence3

iCloud Token Extraction. Accessing all iCloud services of the user through extracted tokens or passwords... Google Chrome Password Extraction. Auto Keychain decryption upon discovery of kc password.

T1649Steal or Forge Authentication CertificatesEvidence2

The installer.py script is in fact a copy of chainbreaker, an open-source project for extracting passwords, keys and certificates from a macOS keychain database.

Discovery

2 techniques

T1069Permission Groups DiscoveryEvidence1

These tools allow operators find possible exploits or paths for privilege escalation based on stored credentials, user permissions, kernel version and distro version.

T1082System Information DiscoveryEvidence1

These tools allow operators find possible exploits or paths for privilege escalation based on stored credentials, user permissions, kernel version and distro version.

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

Upload / Download any file[s]... Bella leverages keychaindump, VNC, microphone streaming, etc, by sending base64 encoded C binaries over to the Bella server / target.

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

splunk researchNews

Feb 26, 2026

Analytics Story: MacOS Post-Exploitation | Splunk Security Content

A macOS post-exploitation tool associated with extracting or analyzing stored credentials, referenced as part of a toolkit for identifying escalation paths.

sentinelone blogNews

Jul 25, 2023

Apple Crimeware | Massive Rust Infostealer Campaign Aiming for macOS Sonoma Ahead of Public Release

An open-source macOS keychain extraction tool used within the malicious installer/script chain to retrieve passwords, keys, and certificates from the victim’s keychain database.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping8

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

chainbreaker

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

8 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1059Command and Scripting InterpreterEvidence1

Observed MITRE TTPs T1059 Command and Scripting Interpreter (osascript)

Credential Access

4 techniques

T1003OS Credential DumpingEvidence1

T1003.005Cached Domain CredentialsEvidence1

Dump items stored in an OSX Keychain... --dump-keychain-password-hash ... --dump-generic-passwords ... --dump-internet-passwords ... --unlock-file UNLOCK_FILE

T1555Credentials from Password StoresEvidence3

iCloud Token Extraction. Accessing all iCloud services of the user through extracted tokens or passwords... Google Chrome Password Extraction. Auto Keychain decryption upon discovery of kc password.

T1649Steal or Forge Authentication CertificatesEvidence2

The installer.py script is in fact a copy of chainbreaker, an open-source project for extracting passwords, keys and certificates from a macOS keychain database.

Discovery

2 techniques

T1069Permission Groups DiscoveryEvidence1

These tools allow operators find possible exploits or paths for privilege escalation based on stored credentials, user permissions, kernel version and distro version.

T1082System Information DiscoveryEvidence1

These tools allow operators find possible exploits or paths for privilege escalation based on stored credentials, user permissions, kernel version and distro version.

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

Upload / Download any file[s]... Bella leverages keychaindump, VNC, microphone streaming, etc, by sending base64 encoded C binaries over to the Bella server / target.

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

splunk researchNews

Feb 26, 2026

Analytics Story: MacOS Post-Exploitation | Splunk Security Content

A macOS post-exploitation tool associated with extracting or analyzing stored credentials, referenced as part of a toolkit for identifying escalation paths.

sentinelone blogNews

Jul 25, 2023

Apple Crimeware | Massive Rust Infostealer Campaign Aiming for macOS Sonoma Ahead of Public Release

An open-source macOS keychain extraction tool used within the malicious installer/script chain to retrieve passwords, keys, and certificates from the victim’s keychain database.

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping8

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.