Loading story…
Researchers linked multiple macOS cryptomining campaigns to trojanized application installers that launched legitimate apps as decoys while silently deploying Monero miners and persistence mechanisms. SentinelLabs detailed macOS.OSAMiner, an operation active since at least 2015 that spread through cracked or trojanized macOS software, used run-only AppleScripts to obstruct analysis, and fetched later-stage payloads from URLs concealed in public web pages. Earlier reporting on OSX/CreativeUpdater described a similar distribution model through malicious MacUpdate download links for apps such as Firefox, OnyX, and Deeper, where signed disk images bypassed Gatekeeper and installed a miner after opening the real application.
The malware established persistence with LaunchAgents, stored components in user library paths such as ~/Library/Caches/com.apple.XX/ and ~/Library/mdworker/, and deployed Monero mining software including builds based on XMR-STAK-RX and MinerGate. SentinelLabs said the campaign also used anti-analysis and evasion logic, including an embedded AppleScript that killed Activity Monitor, checked for security and cleanup tools such as Avast, Avira, CleanMyMac, Keeper, Lemon, and MacMgr, and used caffeinate plus basic virtual-machine checks to keep mining active. Apple later revoked an abused Developer ID certificate and MacUpdate removed the malicious links tied to the CreativeUpdater distribution chain.
Pull IOCs and campaign context straight into your stack.
8 events from the most recent confirmed update back to the earliest known activity.
In early February 2018, attackers distributed trojanized macOS applications including Firefox, OnyX, and Deeper through malicious download links on MacUpdate. The signed apps bypassed Gatekeeper, launched the legitimate app as a decoy, and installed persistent Monero-mining malware.
On February 1, 2018, a MacUpdate editor account named "Jess-MacUpdate" added comments on several popular applications that were associated with the malicious distribution campaign.
Reports about the malware later identified as macOS.OSAMiner surfaced on Chinese security sites in 2018, describing a Monero-mining trojan affecting macOS users.
SentinelLabs assessed that the macOS.OSAMiner cryptomining malware campaign had likely been circulating since at least 2015.
SentinelLabs released its AEVT decompiler as open source to help analyze malicious run-only AppleScripts such as those used by macOS.OSAMiner.
SentinelLabs combined a public AppleScript disassembler with its AEVT decompiler to statically reverse previously opaque macOS.OSAMiner samples, revealing the malware's multi-stage architecture, persistence, evasion, and miner deployment workflow.
MacUpdate stated that it removed the malicious links used in the CreativeUpdater campaign, reducing the likelihood of further infections through the same vector.
Apple revoked the Developer ID certificate used to sign the malicious CreativeUpdater disk images and applications, disrupting that distribution method.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 43 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
4 references tracked. Mallory keeps watching after this page renders.
labs.sentinelone.com
Open sourcedigitasecurity.com
Open sourcevirustotal.com
Open sourcevirustotal.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers compromised **MacUpdate** and distributed trojanized versions of popular macOS applications including **Firefox**, **OnyX**, and **Deeper**, replacing legitimate downloads with installers that deployed a cryptocurrency miner. Researchers reported the malware as **OSX.CreativeUpdate** / **OSX.CreativeUpdater**, noting that the fake installers were built with **Platypus**, used decoy applications to reduce suspicion, and in some cases exposed operational mistakes when those decoys failed to launch properly. Once installed, the malware established persistence through **LaunchAgents** and ran under a malicious `sysmdworker` process that ultimately launched **`minergate-cli`** to mine **Monero** via connections to **minergate.com**. The campaign also relied on deceptive infrastructure, including lookalike domains such as `titaniumsoftware.org` and `download-installer.cdn-mozilla.net`, while hosting payloads on `public.adobecc.com`, underscoring the risk posed by compromised software distribution channels and third-party download sites for macOS users.
Jun 29, 2026
Researchers reported multiple campaigns distributing macOS infostealers tied to the **AMOS/AtomicStealer** ecosystem, a malware-as-a-service operation that steals credentials, browser data, cryptocurrency wallets, Apple Notes, files, and **Keychain** material from macOS Catalina and newer systems on Intel, M1, and M2 devices. Earlier reporting on related macOS stealers showed operators relying on social engineering, unsigned DMG files, and password prompts to collect sensitive data, package it into archives, and exfiltrate it to command-and-control servers, with some activity also summarized to Telegram channels. More recent campaigns used **malvertising** and fake software or troubleshooting pages to lure users into running Terminal commands that fetched an AMOS variant known as **"malext"**. Investigators said the malware used obfuscated shell commands, `osascript`, quarantine removal, anti-VM and sandbox checks, and in some cases installed persistence through a LaunchDaemon and helper scripts, while also trojanizing Ledger and Trezor applications and capturing administrator passwords. Reporting also linked AMOS delivery to fake **CleanMyMac** sites and AI-themed lures, indicating operators are rapidly rotating ad accounts and adapting infection vectors to broaden theft and remote access on macOS systems.
Jun 29, 2026
Threat actors are increasingly targeting macOS users with **infostealers** and distribution-as-a-service models, reflecting a broader “gold rush” in Apple-focused malware development. Reporting highlights macOS stealers targeting browser credentials and cryptocurrency assets (including seed phrases) and notes tactics to evade Apple controls such as obtaining valid Apple developer signatures to bypass *Gatekeeper*; one cited example is *MacSync* being notarized and signed under Team ID `GNJLS3UYZ4`. The same reporting describes ecosystem-scale enablement, including large-scale compromise of WordPress sites for distribution and novel command-and-control approaches such as using blockchain smart contracts (e.g., on **BNB Smart Chain**), alongside paid-traffic abuse (e.g., promoting malicious AI chat content via ads) to push stealer payloads. Separately, a Darktrace-described investigation details a **multi-stage macOS malware** campaign that prioritizes *social engineering* over exploitation to defeat Apple’s **Transparency, Consent, and Control (TCC)** privacy framework. Victims are lured via phishing to open an AppleScript masquerading as a document (`Confirmation_Token_Vesting.docx.scpt`), which displays a fake “Compatibility” error and instructs the user to launch a “Compatibility Wizard” (e.g., using a keyboard shortcut) that effectively tricks them into authorizing execution and granting access. Together, the reporting indicates macOS threats are increasingly succeeding by combining credential/crypto theft objectives with user-prompt manipulation and trust-abuse techniques rather than relying on kernel or sandbox escapes.
Jun 29, 2026