# VirusTotal Code Insight Reveals Undetected macOS Dropper and iOS Credential-Stealing Tweak in Mach-O Analysis

> VirusTotal's AI-powered Code Insight analyzed 9,981 first-seen Mach-O binaries on 2025-10-18, flagging 164 as malicious versus 67 by traditional AV engines. Findings include a multi-stage macOS dropper fetching an AppleScript payload from foggydoxz.xyz with zero initial detections, and an iOS jailbreak tweak masquerading as a Lightroom feature unlocker that steals credentials via the Telegram Bot API.

- **Published:** 2026-10-19T18:06:16Z
- **Last reviewed:** 2026-10-19T18:06:16Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3908
- **ID:** TL-2026-3908
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2025-10-18 VirusTotal ran its Code Insight AI pipeline over 9,981 unique first-seen Mach-O binaries (macOS and iOS). Traditional AV engines flagged 67 of them; Code Insight identified 164 as malicious and surfaced nearly 100 additional suspicious samples that conventional detection missed. 30 Microsoft binaries were initially flagged as false positives; they were confirmed and fixed by Microsoft on 2025-10-31. VirusTotal's write-up (published 2025-11-06) highlights two representative cases that had zero detections at submission time. No CVE, CVSS score, named threat actor or malware family name is stated in the source.

Case 1 - macOS multi-stage dropper (SHA-256 9adef73a6255f6bcb203e84cbe9304d000f3c5354d3d7bf3fc3b2a0128b624c3). The Mach-O binary downloads an AppleScript payload over HTTPS from foggydoxz.xyz (the /dynamic path serves the payload; /gate is the exfiltration endpoint), bypassing TLS certificate validation. Stages are staged under /tmp (/tmp/test.scpt and /tmp/osalogging.zip) and executed with /usr/bin/osascript in a multi-stage chain. It had zero AV detections when first submitted.

Case 2 - iOS jailbreak tweak (SHA-256 333913409c1e22b5da03c762cbb7d99a9d38ecdf0231cb9ac6db00efc6b3bd97) posing as a Lightroom feature/subscription unlocker, installed as /Library/MobileSubstrate/DynamicLibraries/Lightroom.dylib. It uses method swizzling/hooking against Adobe Lightroom to bypass subscription validation and inject a fake login prompt that captures credentials. Exfiltration uses the Telegram Bot API with an obfuscated bot token, and custom cryptographic routines conceal commands. The sample is tied to a Telegram channel (t.me/blatants) of roughly 38,000 subscribers distributing dylib-injection automation tools (InjectBot, PatchBot, PaidAppScraper, FileDownloader).

Severity and status are analyst-assigned, not stated in the source. A BeaconBeagle domain lookup for foggydoxz.xyz returned no matches.

## MITRE ATT&CK

- T1059.002 AppleScript
- T1071.001 Web Protocols
- T1104 Multi-Stage Channels
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1056.002 GUI Input Capture
- T1417.002 Input Capture: GUI Input Capture
- T1567 Exfiltration Over Web Service

## Sources

- [Reversing at Scale: AI-Powered Malware Analysis (VirusTotal Blog)](https://blog.virustotal.com/2025/11/reversing-at-scale-ai-powered-malware.html)
- [Threat Hunting Advisory - AppleScript-based macOS malware campaigns (Nopal Cyber)](https://www.nopalcyber.com/threat-hunting-advisory/november-18th-v8-2025)
- [MITRE ATT&CK T1059.002 - Command and Scripting Interpreter: AppleScript](https://attack.mitre.org/techniques/T1059/002/)
- [MITRE ATT&CK T1056.002 - Input Capture: GUI Input Capture](https://attack.mitre.org/techniques/T1056/002/)
- [MITRE ATT&CK T1567 - Exfiltration Over Web Service](https://attack.mitre.org/techniques/T1567/)
- [Telegram Bot API documentation](https://core.telegram.org/bots/api)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3908