Loading story…
A refreshed OSX/iMuler malware campaign targeted Mac OS X users by hiding trojanized .app bundles inside ZIP archives and making them appear to be harmless image files. One variant was distributed alongside erotic images, while another archive, Group Photos.zip, contained multiple fake photo applications that relied on default Finder behavior to mask executables as pictures. When opened, the malicious app installed and launched an embedded FileAgent payload, with detections including OSX/Imuler.E, OSX/Imuler-B, Trojan.Muxler.7, and Trojan-Dropper:OSX/Revir.D.
The malware preserved the core behavior of earlier iMuler samples, including stealing files, screenshots, and other data from infected Macs and exfiltrating it over HTTP using zlib-compressed payloads. Analysis also found functionality tied to file copying, daemon initialization, temporary-directory use, and RC4-based encryption, while the updated sample used a newly hardcoded command-and-control domain registered through a Chinese registrar that resolved to the same U.S.-hosted IP address seen in prior variants. Researchers said the changes appeared aimed at improving antivirus evasion, and VirusTotal results cited in the reporting showed the archive and payload were detected by only 6 of 44 engines at the time.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
The ZIP archive carrying disguised .app bundles named like photo files was analyzed on VirusTotal and also showed a 6/44 detection ratio. The archive delivered the FileAgent payload when a user clicked one of the fake image applications.
A FileAgent executable embedded in the malicious app bundles was analyzed on VirusTotal, where it showed a 6/44 detection ratio. The payload was identified by multiple vendors including ESET, Sophos, Trend Micro, DrWeb, and F-Secure under iMuler/Revir-related names.
By March 2012, a new OSX/Imuler variant was being distributed inside a ZIP archive among erotic images, relying on the victim to open a malicious application. The report says this delivery method replaced earlier installation via the OSX/Revir.A dropper while retaining similar data theft and HTTP C2 behavior.
The updated OSX/Imuler variant used a newly hardcoded command-and-control domain that the report says was registered through a Chinese registrar. The domain later resolved to the same U.S.-based IP address used by previous variants.
ESET stated its products detected the updated sample as OSX/Imuler.C starting with signature update 6970. The reference does not provide a calendar date for that signature release.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 12 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are abusing **software-brand impersonation** to trick users into installing malware from fake distribution points, relying on social engineering rather than software exploits. Datadog reported an active campaign using **fake GitHub repositories** that impersonate established technology companies and leverage the **ClickFix** technique—prompting victims to copy/paste commands into *Terminal* (macOS) or *PowerShell/Run* (Windows)—to install infostealers. Datadog observed iterative updates to the *MacSync* lure and a new macOS infostealer variant self-branded as **“SHub Stealer v2.0”**, with expanded capabilities including **persistence** and **remote access**, alongside anti-analysis/evasion features intended to hinder detection and track infection outcomes; Datadog also assessed signs the actor is expanding toward **Windows infostealer** functionality. Separately, Malwarebytes documented a lookalike **7-Zip** download site (`7zip[.]com`, impersonating the legitimate `7-zip.org`) distributing a **trojanized installer** that installs a working 7-Zip File Manager while silently converting infected Windows systems into **residential proxy nodes**. The installer was **Authenticode-signed** with a certificate issued to **Jozeal Network Technology Co., Limited** (now revoked), and it dropped additional components—`Uphero.exe` (service manager/update loader), `hero.exe` (Go-compiled proxy payload), and `hero.dll`—under `C:\Windows\SysWOW64\hero\`; one reported case surfaced via Microsoft Defender detection `Trojan:Win32/Malgent!MSR` after the system had been exposed for an extended period. Together, the reporting highlights a sustained risk from **trusted-brand impersonation** and “looks legitimate” installers/repositories that deliver credential theft or monetize endpoints via proxyware.
Jul 2, 2026
Researchers linked multiple macOS cryptomining campaigns to trojanized application installers that launched legitimate apps as decoys while silently deploying Monero miners and persistence mechanisms. SentinelLabs detailed **macOS.OSAMiner**, an operation active since at least 2015 that spread through cracked or trojanized macOS software, used **run-only AppleScripts** to obstruct analysis, and fetched later-stage payloads from URLs concealed in public web pages. Earlier reporting on **OSX/CreativeUpdater** described a similar distribution model through malicious MacUpdate download links for apps such as Firefox, OnyX, and Deeper, where signed disk images bypassed Gatekeeper and installed a miner after opening the real application. The malware established persistence with **LaunchAgents**, stored components in user library paths such as `~/Library/Caches/com.apple.XX/` and `~/Library/mdworker/`, and deployed Monero mining software including builds based on **XMR-STAK-RX** and **MinerGate**. SentinelLabs said the campaign also used anti-analysis and evasion logic, including an embedded AppleScript that killed Activity Monitor, checked for security and cleanup tools such as Avast, Avira, CleanMyMac, Keeper, Lemon, and MacMgr, and used `caffeinate` plus basic virtual-machine checks to keep mining active. Apple later revoked an abused Developer ID certificate and MacUpdate removed the malicious links tied to the CreativeUpdater distribution chain.
Aug 15, 2026
Threat actors are increasingly using weaponized `.dmg` files disguised as legitimate macOS software installers to deliver infostealer malware, with campaigns relying heavily on social engineering to convince users to bypass Apple Gatekeeper and other trust prompts. Researchers said the malware typically focuses on rapid collection and exfiltration rather than persistence, stealing browser credentials, cookies, authentication tokens, Apple Keychain data, macOS passwords, and cryptocurrency wallet information from infected systems. Multiple macOS stealer families have been tied to the tactic, including **Atomic macOS Stealer (AMOS)**, Poseidon, Odyssey, and MacSync. AMOS in particular has been marketed as malware-as-a-service and distributed through malvertising, SEO poisoning, fake download pages, social media ads, GitHub-hosted binaries, open directories, poisoned search results, and piracy forums while impersonating popular apps such as Notion, Trello, Arc, Slack, Todoist, and CleanMyMac X. Defenders were urged to monitor suspicious DMG mount activity in `/Volumes`, inspect hidden `.background` directories, use OCR on installer graphics, unmount suspicious disk images quickly, and restrict software installation to legitimate, Apple-verified sources outside unofficial or cracked-software channels.
Jun 29, 2026