# The Mac Malware of 2024 - Objective-See annual review of macOS stealers, ransomware and backdoors (BeaverTail, SpectralBlur, LightSpy, NotLockBit)

> Objective-See (Patrick Wardle) reviews the new macOS malware of 2024: stealers dominated (CloudChat, Poseidon, Cthulhu, BeaverTail, PyStealer, Banshee), alongside NotLockBit ransomware and the SpectralBlur, Zuru, LightSpy, HZ Rat, Activator, HiddenRisk, RustDoor and RustyAttr implants. Attribution spans DPRK (BeaverTail, SpectralBlur, HiddenRisk, RustyAttr), China (LightSpy) and Russian-speaking MaaS operators (Poseidon).

- **Published:** 2026-10-31T07:21:48Z
- **Last reviewed:** 2026-10-31T07:21:48Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4887
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-4887.png
- **ID:** TL-2026-4887
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** DPRK (North Korea)
- **Detections:** 9 (1 shown free below) · **IOCs:** 28 (3 shown free below)

## Description

Objective-See's annual review, published 2025-01-01 and covering all new macOS malware seen in 2024, shows stealers as the dominant category and fake or pirated applications as the primary infection vector. Many samples are non-persistent, and cryptocurrency wallets are a consistent theft target. Several specimens were distributed as MaaS.

Stealers: CloudChat arrives as a fake video-meeting application, steals crypto wallets, monitors the clipboard, and exfiltrates over FTP and the Telegram bot API (via curl). Poseidon (Rodrigo, attributed to the Russian-speaking actor Rodrigo4 on XSS forums) spreads through malicious Google ads and pirated applications as MaaS and had zero VirusTotal detections from 2024-05-17. Cthulhu masquerades as CleanMyMac, GTA and Adobe GenP, was initially notarized by Apple, stages data in /Users/Shared/NW/ and exfiltrates a ZIP to 89.208.103.185. BeaverTail (DPRK, linked to TA444/BlueNoroff) is a trojanized MiroTalk fake video-meeting app that steals keychains and wallet browser extensions, posts to 95.164.17.24:1224 (/uploads, /pdown, /client/99) and downloads Python second stages including InvisibleFerret (main99.py). PyStealer is a PyInstaller-packaged fake PDF with anti-VM checks (including MAC OUI), AppleScript password prompts validated with dscl -authonly, Safari cookie theft, and Discord webhook and GoFile exfiltration. Banshee is a MaaS stealer whose source code leaked; it detects Russian locale and the P_TRACED debugging flag.

Ransomware: NotLockBit is an unobfuscated Go binary posing as LockBit that exfiltrates to AWS S3 buckets using hardcoded credentials, encrypts a hardcoded extension list, drops README.txt and changes the wallpaper.

Backdoors and implants: SpectralBlur (DPRK, TA444/BlueNoroff) uses a custom stream cipher (xcrypt), an adjacent config file, a pseudo-terminal via posix_openpt and 15 command handlers. Zuru is delivered through pirated UltraEdit, Navicat and SecureCRT from macyy.cn, persists via the com.apple.fsevents.plist Launch Agent and /Users/Shared/.fseventsd, and pulls the open-source Khepri agent. LightSpy (China) is a plugin-based implant delivered by watering holes (compromised news sites), using /Users/Shared/irc.pid, macmanifest.json and XOR-encoded plugins for audio, camera, screen, keychain, Wi-Fi, LAN, process, file and shell capabilities. HZ Rat arrives in a trojanized OpenVPNConnect.pkg (exe launcher plus init backdoor) and targets WeChat and DingTalk users. Activator comes via torrent-distributed cracked apps, persists with /Library/LaunchAgents/launched.%@.plist, kills NotificationCenter to suppress BTM alerts, and fetches its payload via DNS TXT records (Base64 + AES-CBC) from apple-health.org.

Other items in the review: HiddenRisk (DPRK/BlueNoroff) used phishing links to a fake crypto-news PDF app and ~/.zshenv persistence (novel in 2024). RustDoor (ThiefBucket) used malicious Visual Studio projects with bash in .csproj files and several persistence options. RustyAttr (DPRK/Lazarus) hid scripts in an extended attribute named test. A Flutter-based DPRK downloader disguised as a game was also covered. Several of these were originally notarized and later revoked. Objective-See recommends behavioral detection: non-notarized executables, new Launch Agents, cron jobs, anomalous DNS and process-hierarchy analysis.

Limits: this is a retrospective annual review, not a new incident. No CVEs or CVSS values are stated. Severity is analyst judgment. Hashes were not present in the portions of the article that could be extracted. BeaconBeagle lookups for 95.164.17.24, 45.77.179.89 and 89.208.103.185 returned HTTP 404, so C2 correlation is unverified. The Banshee C2 address in the article text is garbled and is omitted, and hardcoded FTP and S3 credentials are deliberately not reproduced.

## MITRE ATT&CK

- T1566.002 Phishing: Spearphishing Link
- T1204.002 User Execution: Malicious File
- T1059.002 Command and Scripting Interpreter: AppleScript
- T1543.001 Create or Modify System Process: Launch Agent
- T1546.004 Event Triggered Execution: Unix Shell Configuration Modification
- T1036 Masquerading
- T1497.001 Virtualization/Sandbox Evasion: System Checks
- T1555.001 Credentials from Password Stores: Keychain
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1016.002 System Network Configuration Discovery: Wi-Fi Discovery
- T1113 Screen Capture
- T1123 Audio Capture
- T1125 Video Capture
- T1071.001 Application Layer Protocol: Web Protocols
- T1071.004 Application Layer Protocol: DNS
- T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage
- T1048.003 Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol
- T1491.001 Defacement: Internal Defacement

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**BeaverTail Fake Meeting App Stage Download and C2 (macOS) - Exploitation** (`TL-2026-4887-SPL-001`)

Detects the BeaverTail (DPRK, TA444/BlueNoroff) delivery chain on macOS endpoints: command lines that touch the reported C2 95.164.17.24:1224 (/uploads, /pdown, /client/99), the DPRK downloader infrastructure mbupdate.linkpc.net / 87.120.114.121, the fake MiroTalk site mirotalk.net, or the InvisibleFerret second stage main99.py, plus the behaviour of a trojanized MiroTalk/FreeConference meeting app spawning curl, python, osascript or a shell. Behaviour-first branch still fires when the IOCs rotate.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1566.002, T1204.002, T1105, T1071.001, T1036
- **Data sources:** crowdstrike_falcon:ProcessRollup2, defender_for_endpoint:DeviceProcessEvents, macos_process_creation
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=edr sourcetype="CrowdStrike:Event:Streams:JSON" event_platform=Mac event_simpleName=ProcessRollup2 earliest=-24h
| eval cmd=lower(CommandLine), proc=lower(FileName), parent=lower(ParentBaseFileName)
| eval ioc_hit=if(match(cmd, "95[.]164[.]17[.]24|87[.]120[.]114[.]121|mbupdate[.]linkpc[.]net|mirotalk[.]net|/pdown|/client/99|main99[.]py"), 1, 0)
| eval lure_child=if(match(parent, "mirotalk|freeconference") AND match(proc, "^(curl|wget|python3?|osascript|bash|sh|zsh|node)$"), 1, 0)
| eval c2_port=if(match(proc, "^(curl|wget)$") AND match(cmd, ":1224/"), 1, 0)
| where ioc_hit=1 OR lure_child=1 OR c2_port=1
| stats count earliest(_time) as first_seen latest(_time) as last_seen values(CommandLine) as command_lines values(ParentBaseFileName) as parents max(ioc_hit) as ioc_hit max(lure_child) as lure_child max(c2_port) as c2_port by ComputerName, UserName
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
let beavertail_terms = dynamic(['95.164.17.24','87.120.114.121','mbupdate.linkpc.net','mirotalk.net','/pdown','/client/99','main99.py']);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where ProcessCommandLine has_any (beavertail_terms)
    or (InitiatingProcessFileName has_any ('MiroTalk','FreeConference') and FileName in~ ('curl','wget','python3','python','osascript','bash','sh','zsh','node'))
    or (FileName in~ ('curl','wget') and ProcessCommandLine has ':1224/')
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| order by Timestamp desc
```

### Sigma

```yaml
title: BeaverTail Fake Meeting App Stage Download and C2 on macOS
id: 3b8e5f10-7a42-4c9d-b1e6-5d2a90c4f101
status: experimental
description: Detects BeaverTail (DPRK TA444/BlueNoroff) delivery on macOS - command lines referencing the reported C2 95.164.17.24:1224, mbupdate.linkpc.net, the fake MiroTalk site, or the InvisibleFerret main99.py stage, and a trojanized MiroTalk/FreeConference app spawning download or scripting tools.
references:
    - https://objective-see.org/blog/blog_0x7D.html
    - https://thehackernews.com/2024/10/n-korean-hackers-use-fake-interviews-to.html
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/10/31
tags:
    - attack.initial-access
    - attack.t1566.002
    - attack.execution
    - attack.t1204.002
    - attack.command-and-control
    - attack.t1105
    - attack.t1071.001
    - attack.defense-evasion
    - attack.t1036
logsource:
    category: process_creation
    product: macos
detection:
    selection_ioc:
        CommandLine|contains:
            - '95.164.17.24'
            - '87.120.114.121'
            - 'mbupdate.linkpc.net'
            - 'mirotalk.net'
            - '/pdown'
            - '/client/99'
            - 'main99.py'
    selection_lure_child:
        ParentImage|contains:
            - 'MiroTalk'
            - 'FreeConference'
        Image|endswith:
            - '/curl'
            - '/wget'
            - '/python3'
            - '/osascript'
            - '/bash'
            - '/sh'
            - '/zsh'
            - '/node'
    selection_c2_port:
        Image|endswith:
            - '/curl'
            - '/wget'
        CommandLine|contains: ':1224/'
    condition: 1 of selection_*
falsepositives:
    - Legitimate MiroTalk or FreeConference clients that shell out to helper utilities
    - Developers testing self-hosted MiroTalk instances
level: high
```

**Known false positives:**

- Legitimate MiroTalk or FreeConference desktop clients that launch helper utilities such as curl
- Developers testing a self-hosted MiroTalk instance that reference mirotalk.net in scripts

**Tuning notes:** Swap index=edr and the CrowdStrike sourcetype for your macOS process-telemetry source (Jamf Protect, osquery process_events). Allow-list sanctioned meeting-app bundle paths in the parent-process branch. The IOC branch uses unverified C2 values (BeaconBeagle returned 404), so treat a hit as high-priority triage rather than confirmed compromise, and refresh the IOC regex from the platform feed.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Trojanized Pirated App, HZ Rat Installer and RustDoor Build Loader Staging (macOS) - Exploitation (locked: unlock with TL Creds)
- macOS Implant Persistence - Launch Agents, .zshenv and Known Implant Artifact Paths - Post-Exploitation (locked: unlock with TL Creds)
- macOS Malware C2 and Payload Hosts - DPRK, Zuru, RustyAttr and Community Sibling Infrastructure (locked: unlock with TL Creds)
- RustyAttr Extended Attribute Script Execution and Secondary Payload Fetch (macOS) - Exploitation (locked: unlock with TL Creds)
- macOS Malware Evasion and Impact - NotificationCenter Kill, VM Checks and Ransom Wallpaper Change - Post-Exploitation (locked: unlock with TL Creds)
- Activator DNS TXT Payload Delivery and Malware Payload Domain Lookups - C2 (locked: unlock with TL Creds)
- macOS Stealer Credential Theft - AppleScript Password Prompt, Keychain and Browser Data (PyStealer/Cthulhu/CloudChat) (locked: unlock with TL Creds)
- macOS Stealer Exfiltration - FTP, ZIP Upload, Telegram, Discord, GoFile and S3 (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 28)

Defanged, TLP:CLEAR.

- IP address: `95.164.17[.]24`
- Domain: `mbupdate[.]linkpc[.]net`
- URL: `hxxp://download[.]ultraedit[.]info/bd.log`

Full set of 28 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [The Mac Malware of 2024](https://objective-see.org/blog/blog_0x7D.html)
- [BeaverTail and InvisibleFerret malware target job-seeking Mac users (Intego)](https://intego.com/mac-security-blog/beavertail-and-invisibleferret-malware-target-job-seeking-mac-users)
- [New Version of BeaverTail macOS Malware Identified (Duo Decipher)](https://duo.com/decipher/new-version-of-beavertail-macos-malware-identified)
- [North Korean Threat Actors Infect Developers with Cross-Platform Malware via Fake Interviews (Rewterz)](https://rewterz.com/threat-advisory/north-korean-threat-actors-infect-developers-with-cross-platform-malware-via-fake-interviews-active-iocs)
- [North Korean Threat Actors (Unit 42)](https://unit42.paloaltonetworks.com/north-korean-threat-actors/)
- [North Korean Hackers Update BeaverTail Malware (The Hacker News)](https://thehackernews.com/2024/07/north-korean-hackers-update-beavertail.html)
- [DPRK Hackers Tweak Malware to Lure macOS Users into Video Calls (Dark Reading)](https://www.darkreading.com/threat-intelligence/dprk-hackers-tweak-malware-to-lure-macos-users-into-video-calls)
- [N. Korean Hackers Use Fake Interviews to Infect Developers with Cross-Platform Malware (The Hacker News)](https://thehackernews.com/2024/10/n-korean-hackers-use-fake-interviews-to.html)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4887