Loading story…
The FruitFly macOS backdoor operated undetected for years, giving attackers covert access to infected Macs through a malware set built largely from Perl scripts with helper components including a Mach-O binary and a Java class. The malware could execute commands, capture screenshots, log keystrokes, access webcams, collect system information, and enumerate other devices on the same network before exfiltrating data to command-and-control infrastructure. Research by Patrick Wardle on a newer variant found decrypted backup domains, and after one domain was registered, nearly 400 infected Macs checked in, most of them from home networks in the United States.
The campaign came under wider scrutiny after Case Western Reserve University was alerted to an infection and identified more than 100 additional compromised systems, prompting FBI involvement. Malwarebytes publicly disclosed FruitFly after finding earlier samples on a small number of Macs, and Apple subsequently updated macOS to detect that version. Investigators later tied the operation to Phillip Roman Durachinsky, raided locations linked to him over fears evidence could be deleted, and ultimately collected about 20 million files, identified thousands of victims, and uncovered child sexual abuse material; Durachinsky was arrested and later indicted on 16 counts.
Pull IOCs and campaign context straight into your stack.
14 events from the most recent confirmed update back to the earliest known activity.
Prosecutors filed their response to the defense motion to suppress evidence.
The defense filed a motion to suppress evidence, arguing improper seizure and seeking to exclude laptop-derived evidence and a confession.
Phillip Roman Durachinsky was indicted on 16 counts, including charges related to damaging and accessing protected computers, child pornography production, wire fraud, aggravated identity theft, unauthorized access to a government computer, and illegal wiretapping.
The FBI issued a FLASH containing FruitFly malware details.
Phillip Roman Durachinsky was arrested in connection with the FruitFly investigation.
A warrant authorizing access to the seized data was signed at 4:40 a.m. EST. Investigators later collected about 20 million files, identified thousands of victims, and found child pornography in the evidence.
Later the same day as the public disclosure, the FBI raided the home of Durachinsky's parents because of concerns that evidence might be deleted. Agents seized a powered-on laptop that was allegedly being remotely controlled, along with numerous hard drives.
An MRT update was released in connection with FruitFly on the same day as the public disclosure, adding detection for the earlier malware variant.
Malwarebytes publicly released its discovery of FruitFly. The earlier variant had been found infecting four Macs, and Apple also updated macOS to automatically detect that earlier malware.
Investigators identified Phillip Roman Durachinsky as a suspect in the FruitFly case, aided by evidence including an IP address tied to the malware and access to an alumni email account.
After the university identified additional infected systems, the FBI was contacted about the FruitFly investigation.
Case Western Reserve University was notified of a FruitFly infection and subsequently found more than 100 additional infected systems. The compromised computers had reportedly been infected for several years.
Patrick Wardle authored a 2017 Virus Bulletin paper analyzing the newer OSX/FruitFly.B variant by redirecting it to a custom command-and-control server. The paper disclosed technical details including its persistence mechanism, C2 infrastructure, use of TCP port 22, and remote-control capabilities such as screen capture, file operations, mouse movement, and keyboard simulation.
Patrick Wardle decrypted hardcoded backup domains in a newer FruitFly variant and registered one that was still available. Within two days, nearly 400 infected Macs connected to his server, most appearing to be home systems in the United States.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
5 references tracked. Mallory keeps watching after this page renders.
arstechnica.com
Open sourceobjective-see.com
Open sourcevirusbulletin.com
Open sourceobjective-see.com
Open sourceobjectivebythesea.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Flashback** malware infected more than 500,000 Mac systems—and by some estimates more than 600,000—after evolving from fake Adobe Flash Player installers to **drive-by compromise via malicious Java applets**. Researchers tied the largest wave to exploitation of Java flaws including `CVE-2012-0507` and `CVE-2011-3544`, which allowed compromised websites to silently drop malware on vulnerable OS X hosts. Doctor Web said its telemetry showed about **817,879** bots had connected at some point, with roughly **550,000** systems still checking in during a 24-hour period and around **650,000** remaining infected overall, disputing lower public estimates. Technical analysis showed Flashback used a hidden Mach-O installer, persistence via a plist, and a second-stage library that intercepted **HTTP and HTTPS** traffic by abusing `DYLD_INSERT_LIBRARIES` and CoreFoundation stream interposition. The malware encrypted components with **RC4** keys derived from each victim Mac’s Platform or Hardware UUID, generated large numbers of domains for command-and-control, validated updates with hard-coded **RSA** signatures, and even used a **Twitter hashtag** fallback for C2 discovery. Its operators appeared focused on **ad fraud and traffic manipulation**, including harvesting Google search-related data and altering responses to simulate ad clicks, while Apple later issued Java patches and a dedicated removal tool to contain the outbreak.
Aug 15, 2026
Researchers detailed how the **WINDSHIFT** APT group deployed the `OSX.WindTail` implant in cyber-espionage operations against selected individuals tied to Middle Eastern government and critical infrastructure organizations. The malware was delivered through phishing-linked web pages that abused macOS custom URL scheme handling to launch a downloaded application with minimal user interaction, then established persistence by copying itself into `~/Library`, hiding its interface, and adding itself as a login item. The implant generated a unique identifier, searched for documents including `doc`, `docx`, `pdf`, `xls`, `xlsx`, `ppt`, and `txt`, compressed stolen files with `zip`, and exfiltrated them with `curl` to attacker-controlled domains including `string2me.com` and `flux2key.com`. The reporting also highlighted a broader macOS tradecraft pattern in which malware abuses Apple Launch Services registration to gain execution outside traditional launch agents and daemons. Separate analysis of the **Mac File Opener** malware showed how malicious apps can register as handlers for hundreds of file types through `Info.plist`, allowing the operating system to invoke them when users open files and helping them evade security tools focused only on standard persistence artifacts. Together, the cases show attackers exploiting legitimate macOS application registration features, signed apps, and user-driven execution paths to reduce visibility, while defenders are urged to monitor anomalous apps in `~/Library`, suspicious login items, unusual handler registrations, and outbound data theft activity.
Aug 15, 2026
An exposed staging environment uncovered by CloudSEK revealed a financially motivated, Chinese-speaking threat operator using multiple AI coding agents as an autonomous offensive platform to support cryptocurrency theft and mass compromise operations. Files in the open directory documented two campaigns running from 10 July to 28 July 2026: opportunistic WordPress exploitation for cryptojacking and targeted intrusions against cryptocurrency and DeFi organizations. The leaked workspace contained more than **12,000** WordPress backdoor records, **66** harvested administrator credential sets, a reconnaissance corpus covering **3.4 million** hosts, live API keys and admin tokens, and stolen cryptocurrency wallet private keys and seed phrases. CloudSEK said the operator managed agents through Telegram, disabled approval safeguards, and reused a fake Chinese-language "authorized pentest" jailbreak prompt to drive offensive actions, while also developing a blockchain-based `DeadDropC2` framework that appeared to remain in local testing. A separate exposed repository on `45.61.136.49` showed the same broader pattern of openly accessible attacker infrastructure, this time serving macOS malware through downloader scripts named **Chrome**, **claude**, and **codex**. Those scripts retrieved a Mach-O universal binary called `codexclod`, cleared macOS quarantine attributes, made the file executable, and launched it, suggesting a delivery chain designed to lure Apple users with trusted software and AI-brand filenames. Investigators found no victim databases or proprietary documents in that repository, but the staging setup reinforced how misconfigured attacker infrastructure can expose active payload delivery, tooling, and operational tradecraft tied to credential compromise and crypto-focused theft.
Aug 20, 2026