LightSpy macOS Implant Used Older Exploits to Deploy Modular Surveillance Tools
Malware Intelligence · 2 sources · Updated 30d ago · First seen Jan 1, 2012
Researchers analyzed a historical macOS variant of LightSpy, a modular surveillance framework delivered using vulnerabilities CVE-2018-4233 and CVE-2018-4404 against older macOS systems. The infection chain installed a persistent loader, a surveillance Core, and 10 plugins enabling communication interception, credential theft, audiovisual surveillance, file manipulation, network discovery, and remote shell access. Shared encryption, configuration formats, database structures, and infrastructure linked the implant to LightSpy’s Android and iOS variants.
ThreatFabric identified 103.27.109[.]217 as the only confirmed macOS campaign server. Authentication failures exposed an administration panel containing device records and exfiltrated information, but researchers assessed that the records probably represented attacker test devices and security researchers’ systems rather than genuine victims. Activity likely dated to around 2022; the investigation did not establish attacks against recent macOS versions or confirm Linux or router implants. The findings highlight surveillance risks for legacy macOS systems without demonstrating a current campaign against fully updated Macs.
