Threat reportMalwareTL-2026-3908
VirusTotal Code Insight Reveals Undetected macOS Dropper and iOS Credential-Stealing Tweak in Mach-O Analysis
VirusTotal Code Insight Reveals Undetected macOS Dropper and (TL-2026-3908) is a medium-severity malware campaign, first published 2026-10-19. It has no confirmed attribution, affects Apple macOS, maps to 8 MITRE ATT&CK techniques (T1027, T1036, T1056.002), and is covered by 9 detection rules and 15 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 8MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 15Indicators of compromise
Key facts for TL-2026-3908
- Threat ID
- TL-2026-3908
- Severity
- MEDIUM
- Status
- MONITORING
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- consumer, technology, creative-professionals
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 15
Malware and tooling in VirusTotal Code Insight Reveals Undetected macOS Dropper and
Malware and tooling: telegram, FileDownloader, InjectBot, PaidAppScraper, PatchBot
How VirusTotal Code Insight Reveals Undetected macOS Dropper and works
VirusTotal's AI-powered Code Insight analyzed 9,981 first-seen Mach-O binaries on 2025-10-18, flagging 164 as malicious versus 67 by traditional AV engines. Findings include a multi-stage macOS dropper fetching an AppleScript payload from foggydoxz.xyz with zero initial detections, and an iOS jailbreak tweak masquerading as a Lightroom feature unlocker that steals credentials via the Telegram Bot API.
On 2025-10-18 VirusTotal ran its Code Insight AI pipeline over 9,981 unique first-seen Mach-O binaries (macOS and iOS). Traditional AV engines flagged 67 of them; Code Insight identified 164 as malicious and surfaced nearly 100 additional suspicious samples that conventional detection missed. 30 Microsoft binaries were initially flagged as false positives; they were confirmed and fixed by Microsoft on 2025-10-31. VirusTotal's write-up (published 2025-11-06) highlights two representative cases that had zero detections at submission time. No CVE, CVSS score, named threat actor or malware family name is stated in the source.
Case 1 - macOS multi-stage dropper (SHA-256 9adef73a6255f6bcb203e84cbe9304d000f3c5354d3d7bf3fc3b2a0128b624c3). The Mach-O binary downloads an AppleScript payload over HTTPS from foggydoxz.xyz (the /dynamic path serves the payload; /gate is the exfiltration endpoint), bypassing TLS certificate validation. Stages are staged under /tmp (/tmp/test.scpt and /tmp/osalogging.zip) and executed with /usr/bin/osascript in a multi-stage chain. It had zero AV detections when first submitted.
Case 2 - iOS jailbreak tweak (SHA-256 333913409c1e22b5da03c762cbb7d99a9d38ecdf0231cb9ac6db00efc6b3bd97) posing as a Lightroom feature/subscription unlocker, installed as /Library/MobileSubstrate/DynamicLibraries/Lightroom.dylib. It uses method swizzling/hooking against Adobe Lightroom to bypass subscription validation and inject a fake login prompt that captures credentials. Exfiltration uses the Telegram Bot API with an obfuscated bot token, and custom cryptographic routines conceal commands. The sample is tied to a Telegram channel (t.me/blatants) of roughly 38,000 subscribers distributing dylib-injection automation tools (InjectBot, PatchBot, PaidAppScraper, FileDownloader).
Severity and status are analyst-assigned, not stated in the source. A BeaconBeagle domain lookup for foggydoxz.xyz returned no matches.
MITRE ATT&CK techniques used in TL-2026-3908
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading
Credential Access
Execution
Command and Control
T1071.001 Web Protocols; T1104 Multi-Stage Channels
credential-access
T1417.002 Input Capture: GUI Input Capture
Exfiltration
Affected products and versions in VirusTotal Code Insight Reveals Undetected macOS Dropper and
- Apple — macOS
Vulnerable versions: Hosts executing the unsigned dropper Mach-O (no specific version stated in source) - Apple — iOS (jailbroken devices using MobileSubstrate tweaks)
Vulnerable versions: Jailbroken devices with Lightroom.dylib tweak installed (no specific version stated in source) - Adobe — Lightroom (iOS) - targeted by tweak hooks
Vulnerable versions: Not specified in source
Remediation for VirusTotal Code Insight Reveals Undetected macOS Dropper and
Immediate actions
- Block foggydoxz.xyz at DNS, proxy and egress firewall
- Hunt endpoints for the SHA-256 hashes and the /tmp/test.scpt and /tmp/osalogging.zip artifacts
- Alert on osascript executed by an unsigned or recently downloaded Mach-O binary
- Remove Lightroom.dylib from /Library/MobileSubstrate/DynamicLibraries on jailbroken iOS devices and rotate credentials entered on them
Workarounds
- Do not run unsigned Mach-O binaries from untrusted sources; keep Gatekeeper and notarization enforcement enabled
- Do not install cracked or unlocker tweaks for paid iOS applications
Longer-term hardening
- Add behavioral (non-signature) analysis of Mach-O binaries to detection pipelines, since both samples had zero AV detections at submission
- Monitor egress to api.telegram.org from endpoints and servers where Telegram is not a business tool
- Restrict or prohibit jailbroken iOS devices and tweak installation in managed environments
Timeline of VirusTotal Code Insight Reveals Undetected macOS Dropper and
- iOS jailbreak tweak (SHA-256 33391340...bd97) posing as a Lightroom feature unlocker and exfiltrating credentials via the Telegram Bot API identified with zero AV detections at submission.
- Multi-stage macOS dropper (SHA-256 9adef73a...b624c3) fetching an AppleScript payload from foggydoxz.xyz identified with zero AV detections at submission.
- VirusTotal Code Insight analyzed 9,981 first-seen Mach-O binaries; 164 flagged malicious by Code Insight versus 67 by traditional AV engines, with nearly 100 additional suspicious samples missed by conventional detection.
- 30 Microsoft binaries initially flagged by Code Insight were confirmed as false positives and fixed by Microsoft.
- VirusTotal published 'Reversing at Scale: AI-Powered Malware Analysis' documenting the findings.
- Nopal Cyber threat hunting advisory published on related AppleScript-based macOS malware campaigns (does not reference these specific samples).
Sources cited for VirusTotal Code Insight Reveals Undetected macOS Dropper and
- Reversing at Scale: AI-Powered Malware Analysis (VirusTotal Blog)
- Threat Hunting Advisory - AppleScript-based macOS malware campaigns (Nopal Cyber)
- MITRE ATT&CK T1059.002 - Command and Scripting Interpreter: AppleScript
- MITRE ATT&CK T1056.002 - Input Capture: GUI Input Capture
- MITRE ATT&CK T1567 - Exfiltration Over Web Service
- Telegram Bot API documentation
Detection coverage for TL-2026-3908
As of 2026-10-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3908 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.