Loading malware…
JokerSpy is a partially uncovered cross-platform malware toolkit associated with intrusions against macOS environments, including a documented compromise of a Japan-based cryptocurrency exchange. Publicly analyzed components include Python backdoors commonly referred to as sh.py and shared.dat, and a macOS Swift binary known as xcc. The toolkit appears designed for post-compromise control, host profiling, permission assessment, and staging of additional tooling, with evidence suggesting that additional components may exist beyond those publicly identified.
The Python backdoor components provide remote command execution and host management functions. Observed capabilities include collection of basic host information, directory listing, shell command execution, changing directories, file deletion, file upload and download, execution of files or Python code, and configuration management. One variant, shared.dat, also supports downloading and launching additional payloads across macOS and Linux, indicating a modular architecture intended to extend functionality after initial deployment. The malware communicates with command-and-control infrastructure using periodic beaconing and stores local configuration data for persistence of operational parameters.
The macOS xcc component is a Swift binary built for both Intel and Apple Silicon systems and targets modern macOS versions. Its behavior centers on checking user privacy and accessibility permissions governed by Transparency, Consent, and Control, including Full Disk Access, Screen Recording, and Accessibility. It also checks whether the screen is locked and identifies the foreground application. In at least one intrusion, xcc was used in conjunction with replacement of the TCC database, behavior consistent with attempts to suppress prompts or bypass user-consent protections. These actions suggest preparation for surveillance or collection activity, although the publicly analyzed xcc samples did not themselves contain a full spyware module.
JokerSpy has also been observed deploying Swiftbelt, an open-source macOS enumeration utility, as follow-on tooling for local discovery. Additional staged libraries observed during the same intrusion were assessed as potentially supporting defense evasion or future exploitation. Investigators assessed that initial access in the documented macOS case likely occurred through a malicious or backdoored plugin or third-party dependency used by developer applications, rather than through a conventional phishing chain.
The activity has been linked by multiple researchers to a DPRK-associated campaign cluster based on tradecraft and targeting patterns, though public reporting has focused more on the intrusion set than on a definitive actor attribution for every JokerSpy sample. Overall, JokerSpy is best characterized as a modular backdoor toolkit used in targeted operations against macOS, with cross-platform Python components, strong post-exploitation utility, and a particular emphasis on reconnaissance, permission checking, and stealthy follow-on execution in cryptocurrency-related environments.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
16 distinct techniques documented for this family, organized by ATT&CK tactic.
The backdoor receives a cmdType 501 command ... as well as the results of the following commands: ifconfig -a ... on a Unix system; ipconfig /all ... on a Windows machine.
The backdoor receives a cmdType 501 command, it extracts details such as Current Time, Username, Hostname, OS Version.
These details are also written to a file received as an argument – in our case, the file is called called b.dat ... ps -ef when executed on a Unix system; ipconfig /all and tasklist /svc when executed on a Windows machine.
xcc checks for permissions managed by Apple's TCC (Transparency, Consent and Control), such as Full Disk Access, Screen Recording and Accessibility.
When the backdoor receives a cmdType 501 command, it extracts details such as Current Time, Username, Hostname, OS Version, as well as the results of the following commands: ifconfig -a and ps -ef when executed on a Unix system; ipconfig /all and tasklist /svc when executed on a Windows machine.
The malware then enters a while True loop where it attempts to communicate with a remote server using a custom packet format. These packets start with either GITHUB_RES or GITHUB_REQ + the UID generated in the previous step.
For MacOS devices, the function writes a file to /Users/Shared/AppleAccount.tgz. The content that is written to the archive is also encoded as base64 when received from server. It unpacks the archive to the /Users/Shared folder, then opens the /Users/Shared/TempUser/AppleAccountAssistant.app application.
12 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A macOS-focused backdoor/toolset used in the REF9134 intrusion. The Python-based sh.py backdoor loads configuration from ~/Public/Safari/sar.dat, beacons to C2, collects host information, and supports commands for shell execution, file transfer, configuration updates, and execution of additional payloads. The associated xcc component is a self-signed Swift binary used to evaluate system permissions and assist in TCC bypass activity.
A multi-component cross-platform malware toolkit targeting macOS primarily, with Python backdoors for macOS, Windows, and Linux and a Swift macOS component that checks TCC permissions likely in preparation for spyware activity such as screen capture. Components support host reconnaissance, command execution, file upload/download, configuration management, and execution of additional payloads.
Mentioned only as prior Elastic research related to a code-signing technique associated with DPRK activity.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.