The Mac Malware of 2024 - Objective-See annual review of macOS stealers, ransomware and backdoors (BeaverTail, SpectralBlur, LightSpy, NotLockBit)

Key facts for 2024 macOS stealer review

Detection coverage for 2024 macOS stealer review

As of 2026-10-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4887 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: BeaverTail Fake Meeting App Stage Download and C2 (macOS) - Exploitation

Detects the BeaverTail (DPRK, TA444/BlueNoroff) delivery chain on macOS endpoints: command lines that touch the reported C2 95.164.17.24:1224 (/uploads, /pdown, /client/99), the DPRK downloader infrastructure mbupdate.linkpc.net / 87.120.114.121, the fake MiroTalk site mirotalk.net, or the InvisibleFerret second stage main99.py, plus the behaviour of a trojanized MiroTalk/FreeConference meeting app spawning curl, python, osascript or a shell. Behaviour-first branch still fires when the IOCs rotate.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1566.002, T1204.002, T1105, T1071.001, T1036
• Data sources: crowdstrike_falcon:ProcessRollup2, defender_for_endpoint:DeviceProcessEvents, macos_process_creation
• Severity: high
• Confidence: high

Splunk SPL

index=edr sourcetype="CrowdStrike:Event:Streams:JSON" event_platform=Mac event_simpleName=ProcessRollup2 earliest=-24h
| eval cmd=lower(CommandLine), proc=lower(FileName), parent=lower(ParentBaseFileName)
| eval ioc_hit=if(match(cmd, "95[.]164[.]17[.]24|87[.]120[.]114[.]121|mbupdate[.]linkpc[.]net|mirotalk[.]net|/pdown|/client/99|main99[.]py"), 1, 0)
| eval lure_child=if(match(parent, "mirotalk|freeconference") AND match(proc, "^(curl|wget|python3?|osascript|bash|sh|zsh|node)$"), 1, 0)
| eval c2_port=if(match(proc, "^(curl|wget)$") AND match(cmd, ":1224/"), 1, 0)
| where ioc_hit=1 OR lure_child=1 OR c2_port=1
| stats count earliest(_time) as first_seen latest(_time) as last_seen values(CommandLine) as command_lines values(ParentBaseFileName) as parents max(ioc_hit) as ioc_hit max(lure_child) as lure_child max(c2_port) as c2_port by ComputerName, UserName
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

let beavertail_terms = dynamic(['95.164.17.24','87.120.114.121','mbupdate.linkpc.net','mirotalk.net','/pdown','/client/99','main99.py']);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where ProcessCommandLine has_any (beavertail_terms)
    or (InitiatingProcessFileName has_any ('MiroTalk','FreeConference') and FileName in~ ('curl','wget','python3','python','osascript','bash','sh','zsh','node'))
    or (FileName in~ ('curl','wget') and ProcessCommandLine has ':1224/')
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| order by Timestamp desc

Sigma

title: BeaverTail Fake Meeting App Stage Download and C2 on macOS
id: 3b8e5f10-7a42-4c9d-b1e6-5d2a90c4f101
status: experimental
description: Detects BeaverTail (DPRK TA444/BlueNoroff) delivery on macOS - command lines referencing the reported C2 95.164.17.24:1224, mbupdate.linkpc.net, the fake MiroTalk site, or the InvisibleFerret main99.py stage, and a trojanized MiroTalk/FreeConference app spawning download or scripting tools.
references:
    - https://objective-see.org/blog/blog_0x7D.html
    - https://thehackernews.com/2024/10/n-korean-hackers-use-fake-interviews-to.html
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/10/31
tags:
    - attack.initial-access
    - attack.t1566.002
    - attack.execution
    - attack.t1204.002
    - attack.command-and-control
    - attack.t1105
    - attack.t1071.001
    - attack.defense-evasion
    - attack.t1036
logsource:
    category: process_creation
    product: macos
detection:
    selection_ioc:
        CommandLine|contains:
            - '95.164.17.24'
            - '87.120.114.121'
            - 'mbupdate.linkpc.net'
            - 'mirotalk.net'
            - '/pdown'
            - '/client/99'
            - 'main99.py'
    selection_lure_child:
        ParentImage|contains:
            - 'MiroTalk'
            - 'FreeConference'
        Image|endswith:
            - '/curl'
            - '/wget'
            - '/python3'
            - '/osascript'
            - '/bash'
            - '/sh'
            - '/zsh'
            - '/node'
    selection_c2_port:
        Image|endswith:
            - '/curl'
            - '/wget'
        CommandLine|contains: ':1224/'
    condition: 1 of selection_*
falsepositives:
    - Legitimate MiroTalk or FreeConference clients that shell out to helper utilities
    - Developers testing self-hosted MiroTalk instances
level: high

Known false positives:

• Legitimate MiroTalk or FreeConference desktop clients that launch helper utilities such as curl
• Developers testing a self-hosted MiroTalk instance that reference mirotalk.net in scripts

Tuning notes: Swap index=edr and the CrowdStrike sourcetype for your macOS process-telemetry source (Jamf Protect, osquery process_events). Allow-list sanctioned meeting-app bundle paths in the parent-process branch. The IOC branch uses unverified C2 values (BeaconBeagle returned 404), so treat a hit as high-priority triage rather than confirmed compromise, and refresh the IOC regex from the platform feed.

• 🔒 Trojanized Pirated App, HZ Rat Installer and RustDoor Build Loader Staging (macOS) - Exploitation · unlock with TL Creds
• 🔒 macOS Implant Persistence - Launch Agents, .zshenv and Known Implant Artifact Paths - Post-Exploitation · unlock with TL Creds
• 🔒 macOS Malware C2 and Payload Hosts - DPRK, Zuru, RustyAttr and Community Sibling Infrastructure · unlock with TL Creds
• 🔒 RustyAttr Extended Attribute Script Execution and Secondary Payload Fetch (macOS) - Exploitation · unlock with TL Creds
• 🔒 macOS Malware Evasion and Impact - NotificationCenter Kill, VM Checks and Ransom Wallpaper Change - Post-Exploitation · unlock with TL Creds
• 🔒 Activator DNS TXT Payload Delivery and Malware Payload Domain Lookups - C2 · unlock with TL Creds
• 🔒 macOS Stealer Credential Theft - AppleScript Password Prompt, Keychain and Browser Data (PyStealer/Cthulhu/CloudChat) · unlock with TL Creds
• 🔒 macOS Stealer Exfiltration - FTP, ZIP Upload, Telegram, Discord, GoFile and S3 · unlock with TL Creds

Indicators of compromise for 2024 macOS stealer review

As of 2026-10-31, Threadlinqs Intelligence tracks 28 indicators of compromise for TL-2026-4887.

Sample indicators (3 of 28)

• IP address: 95.164.17[.]24
• Domain: mbupdate[.]linkpc[.]net
• URL: hxxp://download[.]ultraedit[.]info/bd.log

Defanged, TLP:CLEAR. Full set of 28 indicators: unlock with TL Creds.

How 2024 macOS stealer review works

Objective-See's annual review, published 2025-01-01 and covering all new macOS malware seen in 2024, shows stealers as the dominant category and fake or pirated applications as the primary infection vector. Many samples are non-persistent, and cryptocurrency wallets are a consistent theft target. Several specimens were distributed as MaaS.

Stealers: CloudChat arrives as a fake video-meeting application, steals crypto wallets, monitors the clipboard, and exfiltrates over FTP and the Telegram bot API (via curl). Poseidon (Rodrigo, attributed to the Russian-speaking actor Rodrigo4 on XSS forums) spreads through malicious Google ads and pirated applications as MaaS and had zero VirusTotal detections from 2024-05-17. Cthulhu masquerades as CleanMyMac, GTA and Adobe GenP, was initially notarized by Apple, stages data in /Users/Shared/NW/ and exfiltrates a ZIP to 89.208.103.185. BeaverTail (DPRK, linked to TA444/BlueNoroff) is a trojanized MiroTalk fake video-meeting app that steals keychains and wallet browser extensions, posts to 95.164.17.24:1224 (/uploads, /pdown, /client/99) and downloads Python second stages including InvisibleFerret (main99.py). PyStealer is a PyInstaller-packaged fake PDF with anti-VM checks (including MAC OUI), AppleScript password prompts validated with dscl -authonly, Safari cookie theft, and Discord webhook and GoFile exfiltration. Banshee is a MaaS stealer whose source code leaked; it detects Russian locale and the P_TRACED debugging flag.

Ransomware: NotLockBit is an unobfuscated Go binary posing as LockBit that exfiltrates to AWS S3 buckets using hardcoded credentials, encrypts a hardcoded extension list, drops README.txt and changes the wallpaper.

Backdoors and implants: SpectralBlur (DPRK, TA444/BlueNoroff) uses a custom stream cipher (xcrypt), an adjacent config file, a pseudo-terminal via posix_openpt and 15 command handlers. Zuru is delivered through pirated UltraEdit, Navicat and SecureCRT from macyy.cn, persists via the com.apple.fsevents.plist Launch Agent and /Users/Shared/.fseventsd, and pulls the open-source Khepri agent. LightSpy (China) is a plugin-based implant delivered by watering holes (compromised news sites), using /Users/Shared/irc.pid, macmanifest.json and XOR-encoded plugins for audio, camera, screen, keychain, Wi-Fi, LAN, process, file and shell capabilities. HZ Rat arrives in a trojanized OpenVPNConnect.pkg (exe launcher plus init backdoor) and targets WeChat and DingTalk users. Activator comes via torrent-distributed cracked apps, persists with /Library/LaunchAgents/launched.%@.plist, kills NotificationCenter to suppress BTM alerts, and fetches its payload via DNS TXT records (Base64 + AES-CBC) from apple-health.org.

Other items in the review: HiddenRisk (DPRK/BlueNoroff) used phishing links to a fake crypto-news PDF app and ~/.zshenv persistence (novel in 2024). RustDoor (ThiefBucket) used malicious Visual Studio projects with bash in .csproj files and several persistence options. RustyAttr (DPRK/Lazarus) hid scripts in an extended attribute named test. A Flutter-based DPRK downloader disguised as a game was also covered. Several of these were originally notarized and later revoked. Objective-See recommends behavioral detection: non-notarized executables, new Launch Agents, cron jobs, anomalous DNS and process-hierarchy analysis.

Limits: this is a retrospective annual review, not a new incident. No CVEs or CVSS values are stated. Severity is analyst judgment. Hashes were not present in the portions of the article that could be extracted. BeaconBeagle lookups for 95.164.17.24, 45.77.179.89 and 89.208.103.185 returned HTTP 404, so C2 correlation is unverified. The Banshee C2 address in the article text is garbled and is omitted, and hardcoded FTP and S3 credentials are deliberately not reproduced.

MITRE ATT&CK techniques by tactic:

Discovery

T1016.002 System Network Configuration Discovery: Wi-Fi Discovery

Defense Evasion

T1036 Masquerading; T1497.001 Virtualization/Sandbox Evasion: System Checks

Exfiltration

T1048.003 Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol; T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage

Execution

T1059.002 Command and Scripting Interpreter: AppleScript; T1204.002 User Execution: Malicious File

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1071.004 Application Layer Protocol: DNS

Collection

T1113 Screen Capture; T1123 Audio Capture; T1125 Video Capture

Impact

T1491.001 Defacement: Internal Defacement

Credential Access

T1539 Steal Web Session Cookie; T1555.001 Credentials from Password Stores: Keychain; T1555.003 Credentials from Password Stores: Credentials from Web Browsers

Persistence

T1543.001 Create or Modify System Process: Launch Agent; T1546.004 Event Triggered Execution: Unix Shell Configuration Modification

Initial Access

T1566.002 Phishing: Spearphishing Link

Remediation for 2024 macOS stealer review

Immediate actions

• Block the listed C2 IPs and domains at the perimeter and DNS layer
• Hunt for the listed file paths and Launch Agent names on macOS endpoints
• Rotate credentials, keychain contents and crypto wallet secrets on any host where a stealer ran

Workarounds

• Enforce Gatekeeper and notarization checks via MDM
• Monitor DNS TXT query anomalies and processes that kill NotificationCenter

Longer-term hardening

• Deploy behavioral macOS detection for new Launch Agents, ~/.zshenv and cron changes, and for unsigned or non-notarized binaries making network connections
• Restrict software installation to vetted sources and train users on fake meeting apps, recruiter lures and pirated software

Affected and fixed versions

• Apple — macOS
  Vulnerable versions: Not version-specific; user-execution based

Timeline of 2024 macOS stealer review

• 2023-08-16 locked-ioc-22 (DPRK, TA444/BlueNoroff) first submitted to VirusTotal from Colombia; analyzed in 2024 as the first new macOS malware of the year
• 2024-01-01 Start of the 2024 coverage window for Objective-See's review of new macOS malware
• 2024-05-17 Poseidon stealer (Rodrigo4, MaaS) has zero VirusTotal detections from this date
• 2024-10-09 Press reports that DPRK actors deliver locked-ioc-23 and InvisibleFerret to developers via fake interviews, using trojanized MiroTalk and FreeConference apps for macOS (.dmg) and Windows (.msi)
• 2024-12-31 End of the 2024 coverage window; stealers were the dominant new macOS malware category
• 2025-01-01 Objective-See publishes 'The Mac Malware of 2024' covering CloudChat, Poseidon, Cthulhu, locked-ioc-23, PyStealer, Banshee, locked-ioc-24, locked-ioc-22, Zuru, locked-ioc-27, HZ Rat, Activator and others

Sources cited for 2024 macOS stealer review

• North Korean Threat Actors Infect Developers with Cross-Platform Malware via Fake Interviews (Rewterz) rewterz.com · Advisory
• The Mac Malware of 2024 objective-see.org · Research · 2025-01-01
• North Korean Threat Actors (Unit 42) Unit 42 · Research
• BeaverTail and InvisibleFerret malware target job-seeking Mac users (Intego) intego.com · Blog
• New Version of BeaverTail macOS Malware Identified (Duo Decipher) duo.com · News
• North Korean Hackers Update BeaverTail Malware (The Hacker News) The Hacker News · News · 2024-07-01
• DPRK Hackers Tweak Malware to Lure macOS Users into Video Calls (Dark Reading) Dark Reading · News
• N. Korean Hackers Use Fake Interviews to Infect Developers with Cross-Platform Malware (The Hacker News) The Hacker News · News · 2024-10-09

More in malware

• Fake-download campaign uses trojanized Inno Setup installers to deliver monetization payloads (WorldProxyPool, CharityEngine/BOINC, AW Manager)
• ClickFix Campaign via Microsoft Lookalike Domain (login.microsoftofice.cz) Targeting Czech Company with Unnamed PureBasic/Batch RAT
• Evolution of C2 Infrastructure: Blockchain-Based (On-Chain) C2 and EtherHiding Adoption by UNC5142, UNC5342 and Commodity Malware (Tsundere, SleepyDuck, SharkStealer)
• ClickFix: Fake CAPTCHA/Verification Prompts Deliver Stealers, Loaders and RATs (DeerStealer, HijackLoader, AMOS, NetSupport RAT, WeaselStore)
• Certified Bad: Abuse of Extended Validation Code-Signing Certificates Shared Across Malware Families (SolarMarker et al.)