Loading story…
Researchers reported that OSX/Keydnap targeted macOS users with a two-stage malware chain built to steal credentials and maintain remote access. The threat was delivered in ZIP archives containing disguised Mach-O executables that used misleading file extensions and icons; once launched, the downloader installed a persistent backdoor named icloudsyncd and replaced itself with a decoy document to reduce suspicion. The malware also attempted privilege escalation by displaying a fake administrator prompt and established persistence through LaunchAgents.
The backdoor was designed to extract Keychain contents using code derived from the public Keychaindump proof of concept, giving attackers access to stored credentials. It communicated with command-and-control servers through onion.to Tor2Web proxies over HTTPS and sent RC4-encrypted POST data, while supporting remote updates, payload delivery, command execution, and self-removal. Researchers said the initial infection vector and total victim count were unclear, but the embedded decoy material suggested possible targeting of underground forum users or security researchers.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
A GitHub commit in ESET's malware-research repository added a UPX patch for unpacking Keydnap samples. The commit, identified as dcbcf12 and attributed to marc-etienne, reflects new technical analysis material related to the malware.
ESET reported observing Keydnap backdoor version 1.3.5 in June 2016. The newer version indicated continued development of the malware shortly after the earlier 1.3.1 sample.
ESET reported that Keydnap backdoor version 1.3.1 was first seen in May 2016. This establishes the earliest explicitly dated observation of the malware family in the reference.
ESET published an analysis of OSX/Keydnap, a macOS malware family composed of a downloader and a persistent backdoor that steals keychain contents and maintains remote access. The report documented its disguised ZIP-based delivery, LaunchAgent persistence, fake privilege prompt, and Tor2Web-based command-and-control infrastructure.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 24 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcewelivesecurity.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A newly identified macOS infostealer dubbed **CrashStealer** is being used in active attacks by masquerading as Apple’s crash-reporting utility and abusing a valid Apple Developer ID with notarization to bypass Gatekeeper on first launch. Distributed in a disk image labeled **"Werkbit Setup"**, the malware presents a fake macOS authorization prompt to capture the user’s system password, then steals browser credentials, Keychain data, password manager information, cryptocurrency wallet and extension data, and files from the **Documents** and **Downloads** directories. Researchers said the C++ malware uses a loader to fetch a Base64-obfuscated shell script from GitHub infrastructure, which then downloads the main payload disguised as **`CrashReporter.app`** with the bundle identifier **`com.apple.crashreporter`**. CrashStealer encrypts stolen data with **AES-256-GCM**, packages it into ZIP archives, and exfiltrates it to an attacker-controlled server via **libcurl**; it also establishes persistence by copying and ad hoc re-signing itself before installing a LaunchAgent named **`com.apple.crashreporter.helper`**. Analysts also noted anti-debugging and control-flow obfuscation features designed to complicate detection and reverse engineering.
Jul 30, 2026
Researchers detailed a macOS malware campaign using **ClickFix-style malvertising** and fake Claude download lures to deploy **MacSync Stealer**, an infostealer built to harvest trusted local artifacts rather than rely only on stolen passwords. Victims were redirected from Google ads to spoofed shared Claude chat pages, then tricked into running a Base64-obfuscated shell command that launched multi-stage shell and AppleScript payloads. The malware collected Keychain data, browser credentials, password-manager and wallet extension data, Telegram files, shell histories, cloud keys, Apple Notes content, and selected documents, while also prompting for the macOS password and **Full Disk Access**; if blocked, it added persistence through `~/.zshrc` so it could retry on the next Terminal launch. The theft enabled direct account and asset compromise. SlowMist found the malware could restore stolen **Telegram Desktop** and **Telegram for macOS** session files on another Mac without triggering phone verification or Telegram two-step verification because it reused an already authorized local session. It also targeted **16 wallet applications** and **223 wallet-related browser extension IDs**, harvesting candidate passwords from multiple sources to decrypt wallet data offline. In a more active phase, the malware removed legitimate **Ledger** and **Trezor** apps and replaced them with malicious WebView loaders that displayed attacker-controlled phishing pages to capture recovery phrases. Investigators linked the campaign to multiple malicious domains and Google ad campaign IDs, and published IOCs including IP addresses, URLs, and SHA-256 hashes.
Jul 17, 2026
Researchers reported a new macOS infostealer dubbed **ClickLock Stealer** that tricks users into pasting a malicious `bash` command into Terminal through ClickFix-style pages masquerading as Cloudflare verification prompts. Group-IB said the malware has been active since at least late May and has targeted at least 100 users in 33 countries, with more than half of victims in Europe. Once launched, the malware downloads multiple payloads for browser credential theft, cryptocurrency wallet theft, Keychain theft, password manager and FileZilla credential collection, shell history harvesting, and backdoor installation, then exfiltrates the stolen data to a Telegram bot. Researchers also linked the campaign to LaunchAgent persistence and a backdoor called **goyim** derived largely from GSocket tooling. ClickLock does not rely on a software exploit or privilege escalation; instead, it abuses user execution and suppresses defenses by repeatedly killing visible applications and `NotificationCenter`, sometimes every 210 milliseconds, until victims enter their macOS password and approve Keychain access. Apple separately published guidance warning that scammers increasingly use websites, chat agents, messaging platforms, and email to socially engineer Mac users into pasting unsafe Terminal commands, and said macOS may warn or block commands and scripts associated with known malware. Apple said such alerts mean the Mac has not yet been harmed and advised users not to run untrusted commands or scripts unless they fully trust the source.
Aug 11, 2026