Loading story…
Researchers disclosed an active intrusion cluster dubbed JokerSpy that targeted a prominent Japan-based cryptocurrency exchange with a cross-platform toolkit spanning macOS, Linux, and Python-based malware. Elastic linked the operation to a self-signed Swift binary named xcc and a Python backdoor named sh.py, while Bitdefender identified related components including shared.dat; together, the malware supports command execution, file transfer, host profiling, payload delivery, and command-and-control beacons. Samples were observed in spring 2023, with investigators noting limited public visibility and signs that the toolkit was still only partially uncovered.
On macOS, the attackers used xcc to inspect permissions tied to Transparency, Consent, and Control (TCC), including Screen Recording, Accessibility, and Full Disk Access, and Elastic reported attempts to bypass TCC by replacing the TCC database. The intrusion also involved follow-on tooling such as the open-source enumeration utility Swiftbelt, plus staged non-native cryptographic libraries under /Users/shared/keybag that may have supported defense evasion or later exploitation. Investigators assessed that initial access likely came through a malicious or backdoored plugin or third-party dependency used by developer applications, indicating a supply-chain-style foothold aimed at deeper surveillance or post-compromise activity on macOS systems.
Track how attackers are adapting to this technology.
7 events from the most recent confirmed update back to the earliest known activity.
Elastic Security Labs disclosed an active macOS intrusion cluster tracked as REF9134 targeting a prominent Japan-based cryptocurrency exchange. The report linked the activity to the xcc and sh.py malware components, assessed initial access likely came via a malicious or backdoored plugin or third-party dependency, and released YARA detections.
Bitdefender disclosed a partially uncovered cross-platform malware toolkit dubbed JokerSpy, describing Python backdoors shared.dat and sh.py plus the macOS Swift binary xcc. The report said the toolkit appeared incomplete and suggested additional missing components likely existed.
A compromised macOS system generated a signature alert for MacOS.Hacktool.Swiftbelt, indicating use of the open-source enumeration tool Swiftbelt during the intrusion. Elastic linked this to post-exploitation activity delivered by the sh.py backdoor.
Researchers observed three non-native libraries placed in /Users/shared/keybag/: libcrypto.1.0.0.dylib, libncursesw.5.dylib, and libssl.1.0.0.dylib. Elastic assessed the staging may have supported defense evasion or future exploitation.
Bitdefender reported that the earliest referenced sample tied to the JokerSpy toolkit was anonymously uploaded to VirusTotal. This marked the earliest explicit date anchor for the malware samples discussed in the research.
Objective-See published a blog post titled "Ironing out (the macOS) details of a Smooth Operator (Part I)." The provided reference includes the publication date and title but no additional event details.
Bitdefender reported isolating a second xcc sample dated June 6 that contained only an x86 Mach-O binary. This added another concrete JokerSpy-related artifact to the known sample set.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 14 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
3 references tracked. Mallory keeps watching after this page renders.
elastic.co
Open sourcebitdefender.com
Open sourceobjective-see.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
An exposed staging environment uncovered by CloudSEK revealed a financially motivated, Chinese-speaking threat operator using multiple AI coding agents as an autonomous offensive platform to support cryptocurrency theft and mass compromise operations. Files in the open directory documented two campaigns running from 10 July to 28 July 2026: opportunistic WordPress exploitation for cryptojacking and targeted intrusions against cryptocurrency and DeFi organizations. The leaked workspace contained more than **12,000** WordPress backdoor records, **66** harvested administrator credential sets, a reconnaissance corpus covering **3.4 million** hosts, live API keys and admin tokens, and stolen cryptocurrency wallet private keys and seed phrases. CloudSEK said the operator managed agents through Telegram, disabled approval safeguards, and reused a fake Chinese-language "authorized pentest" jailbreak prompt to drive offensive actions, while also developing a blockchain-based `DeadDropC2` framework that appeared to remain in local testing. A separate exposed repository on `45.61.136.49` showed the same broader pattern of openly accessible attacker infrastructure, this time serving macOS malware through downloader scripts named **Chrome**, **claude**, and **codex**. Those scripts retrieved a Mach-O universal binary called `codexclod`, cleared macOS quarantine attributes, made the file executable, and launched it, suggesting a delivery chain designed to lure Apple users with trusted software and AI-brand filenames. Investigators found no victim databases or proprietary documents in that repository, but the staging setup reinforced how misconfigured attacker infrastructure can expose active payload delivery, tooling, and operational tradecraft tied to credential compromise and crypto-focused theft.
Aug 20, 2026
Microsoft reported that infostealer operators have broadened beyond traditional Windows-focused activity to target **macOS** and mixed-platform environments through social engineering, malicious installers, and abuse of trusted services. Since late 2025, researchers observed campaigns delivering **DigitStealer**, **MacSync**, and **Atomic macOS Stealer (AMOS)** via fake software downloads, malicious `.dmg` files, and **ClickFix**-style prompts that trick users into running Terminal commands, leading to theft of browser credentials, cryptocurrency wallet data, Keychain contents, and developer secrets. The company also linked multiple cross-platform and Python-based operations to the trend, including **PXA Stealer**, attributed to Vietnamese-speaking threat actors targeting government and education organizations through phishing, persistence mechanisms, and Telegram-based exfiltration. Separate campaigns used **WhatsApp** to spread **Eternidade Stealer** with worm-like propagation and pushed a fake **Crystal PDF** installer through malvertising and SEO poisoning to capture browser sessions and credentials. Microsoft said the activity increasingly relies on fileless execution, native utilities, obfuscation, **LOLBINs**, and trusted platforms to evade detection, and published Defender XDR detections, hunting queries, indicators of compromise, and mitigation guidance.
Jun 30, 2026
Threat actors are increasingly targeting macOS users with **infostealers** and distribution-as-a-service models, reflecting a broader “gold rush” in Apple-focused malware development. Reporting highlights macOS stealers targeting browser credentials and cryptocurrency assets (including seed phrases) and notes tactics to evade Apple controls such as obtaining valid Apple developer signatures to bypass *Gatekeeper*; one cited example is *MacSync* being notarized and signed under Team ID `GNJLS3UYZ4`. The same reporting describes ecosystem-scale enablement, including large-scale compromise of WordPress sites for distribution and novel command-and-control approaches such as using blockchain smart contracts (e.g., on **BNB Smart Chain**), alongside paid-traffic abuse (e.g., promoting malicious AI chat content via ads) to push stealer payloads. Separately, a Darktrace-described investigation details a **multi-stage macOS malware** campaign that prioritizes *social engineering* over exploitation to defeat Apple’s **Transparency, Consent, and Control (TCC)** privacy framework. Victims are lured via phishing to open an AppleScript masquerading as a document (`Confirmation_Token_Vesting.docx.scpt`), which displays a fake “Compatibility” error and instructs the user to launch a “Compatibility Wizard” (e.g., using a keyboard shortcut) that effectively tricks them into authorizing execution and granting access. Together, the reporting indicates macOS threats are increasingly succeeding by combining credential/crypto theft objectives with user-prompt manipulation and trust-abuse techniques rather than relying on kernel or sandbox escapes.
Jun 29, 2026