Loading story…
Attackers compromised MacUpdate and distributed trojanized versions of popular macOS applications including Firefox, OnyX, and Deeper, replacing legitimate downloads with installers that deployed a cryptocurrency miner. Researchers reported the malware as OSX.CreativeUpdate / OSX.CreativeUpdater, noting that the fake installers were built with Platypus, used decoy applications to reduce suspicion, and in some cases exposed operational mistakes when those decoys failed to launch properly.
Once installed, the malware established persistence through LaunchAgents and ran under a malicious sysmdworker process that ultimately launched minergate-cli to mine Monero via connections to minergate.com. The campaign also relied on deceptive infrastructure, including lookalike domains such as titaniumsoftware.org and download-installer.cdn-mozilla.net, while hosting payloads on public.adobecc.com, underscoring the risk posed by compromised software distribution channels and third-party download sites for macOS users.
Trace attribution and downstream blast radius.
3 events from the most recent confirmed update back to the earliest known activity.
Objective-See published follow-on analysis of the MacUpdate-delivered macOS malware, adding technical detail to the already disclosed campaign. This represents a later research update rather than a separate incident.
On February 1, 2018, researchers reported that the MacUpdate compromise was being used to spread macOS cryptomining malware with persistence via LaunchAgents and a malicious sysmdworker process. Public reporting also identified related infrastructure, including lookalike domains and payload hosting used in the campaign.
Attackers breached the MacUpdate website and served malicious versions of Firefox, OnyX, and Deeper to macOS users. The trojanized installers delivered a Monero-mining malware later dubbed OSX.CreativeUpdate/OSX.CreativeUpdater.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers linked multiple macOS cryptomining campaigns to trojanized application installers that launched legitimate apps as decoys while silently deploying Monero miners and persistence mechanisms. SentinelLabs detailed **macOS.OSAMiner**, an operation active since at least 2015 that spread through cracked or trojanized macOS software, used **run-only AppleScripts** to obstruct analysis, and fetched later-stage payloads from URLs concealed in public web pages. Earlier reporting on **OSX/CreativeUpdater** described a similar distribution model through malicious MacUpdate download links for apps such as Firefox, OnyX, and Deeper, where signed disk images bypassed Gatekeeper and installed a miner after opening the real application. The malware established persistence with **LaunchAgents**, stored components in user library paths such as `~/Library/Caches/com.apple.XX/` and `~/Library/mdworker/`, and deployed Monero mining software including builds based on **XMR-STAK-RX** and **MinerGate**. SentinelLabs said the campaign also used anti-analysis and evasion logic, including an embedded AppleScript that killed Activity Monitor, checked for security and cleanup tools such as Avast, Avira, CleanMyMac, Keeper, Lemon, and MacMgr, and used `caffeinate` plus basic virtual-machine checks to keep mining active. Apple later revoked an abused Developer ID certificate and MacUpdate removed the malicious links tied to the CreativeUpdater distribution chain.
Aug 15, 2026
Researchers reported multiple campaigns distributing macOS infostealers tied to the **AMOS/AtomicStealer** ecosystem, a malware-as-a-service operation that steals credentials, browser data, cryptocurrency wallets, Apple Notes, files, and **Keychain** material from macOS Catalina and newer systems on Intel, M1, and M2 devices. Earlier reporting on related macOS stealers showed operators relying on social engineering, unsigned DMG files, and password prompts to collect sensitive data, package it into archives, and exfiltrate it to command-and-control servers, with some activity also summarized to Telegram channels. More recent campaigns used **malvertising** and fake software or troubleshooting pages to lure users into running Terminal commands that fetched an AMOS variant known as **"malext"**. Investigators said the malware used obfuscated shell commands, `osascript`, quarantine removal, anti-VM and sandbox checks, and in some cases installed persistence through a LaunchDaemon and helper scripts, while also trojanizing Ledger and Trezor applications and capturing administrator passwords. Reporting also linked AMOS delivery to fake **CleanMyMac** sites and AI-themed lures, indicating operators are rapidly rotating ad accounts and adapting infection vectors to broaden theft and remote access on macOS systems.
Jun 29, 2026
Threat actors are increasingly using weaponized `.dmg` files disguised as legitimate macOS software installers to deliver infostealer malware, with campaigns relying heavily on social engineering to convince users to bypass Apple Gatekeeper and other trust prompts. Researchers said the malware typically focuses on rapid collection and exfiltration rather than persistence, stealing browser credentials, cookies, authentication tokens, Apple Keychain data, macOS passwords, and cryptocurrency wallet information from infected systems. Multiple macOS stealer families have been tied to the tactic, including **Atomic macOS Stealer (AMOS)**, Poseidon, Odyssey, and MacSync. AMOS in particular has been marketed as malware-as-a-service and distributed through malvertising, SEO poisoning, fake download pages, social media ads, GitHub-hosted binaries, open directories, poisoned search results, and piracy forums while impersonating popular apps such as Notion, Trello, Arc, Slack, Todoist, and CleanMyMac X. Defenders were urged to monitor suspicious DMG mount activity in `/Volumes`, inspect hidden `.background` directories, use OCR on installer graphics, unmount suspicious disk images quickly, and restrict software installation to legitimate, Apple-verified sources outside unofficial or cracked-software channels.
Jun 29, 2026