Loading story…
Volexity linked a late-2021 intrusion against an organization in Asia to Storm Cloud, a China-aligned espionage actor, after recovering a previously undocumented macOS variant of the GIMMICK malware family from a compromised MacBook Pro running macOS 11.6 Big Sur. The implant, written primarily in Objective-C, expands a malware set already seen on Windows in .NET and Delphi, indicating a broader multi-platform toolkit aimed at organizations across the region.
The macOS backdoor was built to evade notice by using customized filenames, persistence mechanisms, and communications limited to workdays and working hours, while relying on Google Drive for command-and-control. Volexity said the malware supports reconnaissance, file retrieval and transfer, shell command execution, timing changes, and self-uninstallation; Apple later worked with the firm and pushed XProtect and MRT signatures on March 17, 2022 to detect, block, and remove GIMMICK from affected macOS systems.
TTPs, infrastructure, and targeting history in one profile.
3 events from the most recent confirmed update back to the earliest known activity.
Apple collaborated with Volexity and on March 17, 2022 pushed new XProtect and MRT signatures to block and remove GIMMICK from macOS systems. Volexity said this provided protection for Apple users against the malware.
During forensic and memory analysis of the compromised MacBook Pro, Volexity recovered and identified a previously unreported macOS variant of the GIMMICK malware family. The implant was linked to Storm Cloud and assessed as part of a broader multi-platform malware set that also includes Windows variants.
In late 2021, Volexity detected an intrusion in a monitored environment involving a compromised MacBook Pro running macOS 11.6 Big Sur. The activity included unauthorized use of frp/fast reverse proxy and internal port scanning, and Volexity attributed the intrusion to the China-linked espionage actor Storm Cloud.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcevolexity.com
Open sourcedeveloper.apple.com
Open sourcedeveloper.apple.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
An exposed staging environment uncovered by CloudSEK revealed a financially motivated, Chinese-speaking threat operator using multiple AI coding agents as an autonomous offensive platform to support cryptocurrency theft and mass compromise operations. Files in the open directory documented two campaigns running from 10 July to 28 July 2026: opportunistic WordPress exploitation for cryptojacking and targeted intrusions against cryptocurrency and DeFi organizations. The leaked workspace contained more than **12,000** WordPress backdoor records, **66** harvested administrator credential sets, a reconnaissance corpus covering **3.4 million** hosts, live API keys and admin tokens, and stolen cryptocurrency wallet private keys and seed phrases. CloudSEK said the operator managed agents through Telegram, disabled approval safeguards, and reused a fake Chinese-language "authorized pentest" jailbreak prompt to drive offensive actions, while also developing a blockchain-based `DeadDropC2` framework that appeared to remain in local testing. A separate exposed repository on `45.61.136.49` showed the same broader pattern of openly accessible attacker infrastructure, this time serving macOS malware through downloader scripts named **Chrome**, **claude**, and **codex**. Those scripts retrieved a Mach-O universal binary called `codexclod`, cleared macOS quarantine attributes, made the file executable, and launched it, suggesting a delivery chain designed to lure Apple users with trusted software and AI-brand filenames. Investigators found no victim databases or proprietary documents in that repository, but the staging setup reinforced how misconfigured attacker infrastructure can expose active payload delivery, tooling, and operational tradecraft tied to credential compromise and crypto-focused theft.
Aug 20, 2026
Threat actors are increasingly using weaponized `.dmg` files disguised as legitimate macOS software installers to deliver infostealer malware, with campaigns relying heavily on social engineering to convince users to bypass Apple Gatekeeper and other trust prompts. Researchers said the malware typically focuses on rapid collection and exfiltration rather than persistence, stealing browser credentials, cookies, authentication tokens, Apple Keychain data, macOS passwords, and cryptocurrency wallet information from infected systems. Multiple macOS stealer families have been tied to the tactic, including **Atomic macOS Stealer (AMOS)**, Poseidon, Odyssey, and MacSync. AMOS in particular has been marketed as malware-as-a-service and distributed through malvertising, SEO poisoning, fake download pages, social media ads, GitHub-hosted binaries, open directories, poisoned search results, and piracy forums while impersonating popular apps such as Notion, Trello, Arc, Slack, Todoist, and CleanMyMac X. Defenders were urged to monitor suspicious DMG mount activity in `/Volumes`, inspect hidden `.background` directories, use OCR on installer graphics, unmount suspicious disk images quickly, and restrict software installation to legitimate, Apple-verified sources outside unofficial or cracked-software channels.
Jun 29, 2026
Security researchers reported that **ClickFix** has expanded into an industrialized malware-delivery ecosystem that relies on social engineering rather than software exploits. Attackers use fake CAPTCHA checks, browser updates, meeting errors, and verification prompts to trick users into manually running attacker-supplied commands through trusted tools such as PowerShell, `mshta`, `curl`, Windows Run, or macOS Terminal. ReversingLabs said the ecosystem now supports a wide range of payloads, including **Lumma Stealer**, **DarkGate**, **XWorm**, **AsyncRAT**, **NetSupport**, and **SectopRAT**, while related variants such as **CrashFix**, **FileFix**, **PromptFix**, and **ConsentFix** continue to emerge. The activity is being amplified through large-scale web compromise campaigns. Reports linked the **DriveSurge** actor to active **ClickFix** and **FakeUpdates** operations abusing thousands of compromised websites to distribute malware, while a separate SlowMist investigation documented a Google Sites-hosted phishing campaign targeting Web3 users on macOS with a fake community application flow that pushed victims to download a `.scpt` file or run a Base64-encoded Terminal command. That infection chain delivered a Mach-O stealer resembling **AMOS (Atomic macOS Stealer)**, which harvested browser credentials, cookies, Keychain data, Apple Notes, Telegram Desktop data, and cryptocurrency wallet files before archiving data to `/tmp/lksopo.zip` and exfiltrating it to `86.54.25.213`. Researchers said structural **YARA** detection of lure pages is currently one of the most effective ways to identify these campaigns, which often evade traditional AV and EDR controls because they depend on legitimate tools and user-approved execution.
Jul 18, 2026