Threat reportMalwareTL-2026-4895
The Mac Malware of 2023: macOS Ransomware, Stealers, and DPRK/Iran-Linked APT Malware (Objective-See Annual Review)
The Mac Malware of 2023 (TL-2026-4895), also tracked as The Mac Malware of 2023, is a high-severity malware campaign, first published 2026-10-31. It is attributed to Lazarus Group (North Korea, Iran) with medium confidence, affects Apple macOS, maps to 18 MITRE ATT&CK techniques (T1027, T1036.005, T1056.002), and is covered by 9 detection rules and 24 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 18MITRE ATT&CK
- Actors
- 4Lazarus Group
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 24Indicators of compromise
Key facts for TL-2026-4895
- Threat ID
- TL-2026-4895
- Also known as
- The Mac Malware of 2023, SmoothOperator, AMOS, RustBucket, KandyKorn
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution
- Lazarus Group, APT38, APT42, APT35
- Attribution confidence
- MEDIUM
- Nation-state nexus
- North Korea, Iran
- Motivation
- FINANCIAL
- Target sectors
- cryptocurrency, finance, technology, enterprise, telecoms, consumer
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 24
Malware and tooling in The Mac Malware of 2023
Malware and tooling: AMOS, JokerSpy, KANDYKORN, LockBit, MetaStealer, Pureland, RustBucket (OS X), STRATOFEAR, SmoothOperator, SparkRAT, Jump Cloud
How The Mac Malware of 2023 works
Objective-See's annual review catalogs macOS malware discovered in 2023, including ransomware (LockBit for macOS, Turtle), info-stealers (PureLand, Realst, MetaStealer, AtomicStealer, JaskaGO, MacStealer, GoSorry) and APT malware (SmoothOperator/3CX, RustBucket, NokNok, KandyKorn, ObjCShellz, JumpCloud-related FullHouse.Doored/StratoFear/TieDye, JokerSpy). Several are attributed to DPRK (Lazarus/BlueNoroff) and NokNok to Iran's APT42/Charming Kitten.
This record summarizes the Objective-See 'Mac Malware of 2023' retrospective (Patrick Wardle). It is a roundup of many distinct families rather than a single campaign, so attribution and TTPs vary per family.
Ransomware: LockBit for macOS (sample locker_Apple_M1_64, encrypts files with AES and appends the .lockbit extension, drops a '!!!-Restore-My-Files-!!!' note, logs to /tmp/locker.log, strings XOR-encoded with key 0x39) and Turtle (TurtleRansom-v0-macos-arm64.pkg, AES-CTR encryption of .doc/.docx/.txt files with the .TURTLERANSv0 suffix). Neither was observed with persistence.
Info-stealers: PureLand (fake play-to-earn game sent from a compromised Sandbox employee's email; C2 193.168.141.107:8888), Realst (Rust-based, fake blockchain games distributed via Discord social engineering; 'Pearl Land Launcher.pkg' installs to /Library/PearLand/1.6.2/ and reuses firefox_decrypt.py and chainbreaker), MetaStealer (Go-based, business-themed disk images, exfil to api.osx-mac.com and builder.osx-mac.com), AtomicStealer/AMOS (malvertising and a fake TradingView site, C2 185.106.93.154 via HTTP POST to /sendlog, fake password prompts via osascript), JaskaGO (fake CapCut installer on pirated-software sites, persistence via LaunchAgent service.plist or LaunchDaemon Init.plist, runs commands with sudo), MacStealer (Python-compiled Mach-O named 'weed' sold on dark web forums, C2 mac.cracked23.site plus Telegram exfiltration) and GoSorry (Go dylib liboptimizer.dylib targeting browser data and crypto wallets).
APT malware: the 3CX Desktop App supply-chain compromise (SmoothOperator; trojanized, signed and Apple-notarized app; libffmpeg.dylib stage 1 downloads UpdateAgent stage 2; C2 sbmsa.wiki/blog/_insert and msstorageboxes.com; DPRK-attributed); RustBucket (BlueNoroff; fake PDF viewer plus trigger PDF; Rust final-stage backdoor; anti-VM check via system_profiler; C2 deck.31ventures.info; spoofed MSIE 8 user agent); NokNok (Charming Kitten/APT42/TA453; password-protected ZIP in phishing emails; Swift backdoor persisting via LaunchAgent org.Finder.plist; base64-encoded survey data); KandyKorn (DPRK; Discord social engineering of crypto engineers with a fake arbitrage bot; HLOADER hijacks Discord.app execution flow; 16-command backdoor); ObjCShellz (BlueNoroff; downloads and executes payloads, Swift variant drops /Users/Shared/.pld with chmod 0777); the JumpCloud compromise (DPRK; init.rb Ruby script delivered through the JumpCloud agent downloads lic.dat/lic_bak.dat from primerosauxiliosperu.com to /usr/local/bin/com.docker.vmnat; payloads FullHouse.Doored, StratoFear with LaunchDaemons masquerading as Zoom/Google Keystone/Teams, and TieDye); and JokerSpy (suspected DPRK; xcc TCC.db checker, shared.dat and sh.py Python backdoors; targeted a Japanese crypto exchange; components seen spawned from IntelliJ IDEA, iTerm2 and VS Code).
Also covered: SparkRAT (open-source Go RAT, tracked as DragonSpark by SentinelOne), Geacon/Geacon Plus (Go Cobalt Strike implementations), WSClient (trojan-proxy in cracked apps, DoH C2 resolution via cloudflare-dns.com, persistence via GoogleHelperUpdater.plist), iWebUpdater, a new XLoader variant disguised as OfficeNote, XMRig-based CoinMiner/I2Pminer variants, and the dark-web-advertised hVNC and ShadowVault. A macOS variant of the Triangulation implant was suspected but not detected in the wild. Objective-See concludes that behavior-based detection outperforms signatures for novel macOS threats.
No CVEs or CVSS scores are stated in the article. Severity and status are analyst assessments.
MITRE ATT&CK techniques used in TL-2026-4895
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1497.001 System Checks
Credential Access
T1056.002 GUI Input Capture; T1555.001 Keychain; T1555.003 Credentials from Web Browsers
Discovery
T1057 Process Discovery; T1082 System Information Discovery
Execution
T1059.002 AppleScript; T1059.004 Unix Shell; T1204.002 Malicious File
Command and Control
command-and-control
T1102.002 Bidirectional Communication
Initial Access
T1195.002 Compromise Software Supply Chain; T1566 Phishing
Persistence
T1543.001 Launch Agent; T1543.004 Launch Daemon
stealth
Affected products and versions in The Mac Malware of 2023
- Apple — macOS
Vulnerable versions: Intel and Apple Silicon macOS systems (no version limit stated in source) - 3CX — 3CX Desktop App (macOS)
Vulnerable versions: Trojanized builds distributed in the 2023 supply-chain compromise - JumpCloud — JumpCloud agent / commands framework
Vulnerable versions: Instances exposed to the 2023 compromise
Remediation for The Mac Malware of 2023
Patches
- Update the 3CX Desktop App to a vendor-remediated version and remove the trojanized builds
Immediate actions
- Block the listed C2 domains and IPs at DNS, proxy and firewall layers
- Hunt for the listed file paths, LaunchAgent/LaunchDaemon plists and SHA-256 hashes on macOS endpoints
- Rotate keychain, browser-stored and crypto-wallet credentials on any host where a stealer ran
- Review MDM/JumpCloud command history for unexpected Ruby/shell command execution
Workarounds
- Keep Gatekeeper enabled and avoid launching unsigned or unexpected applications
- Alert on osascript password prompts and bulk keychain or browser-database access
Longer-term hardening
- Deploy behavior-based macOS EDR covering persistence, process-spawn and network anomalies
- Monitor creation of LaunchAgents/LaunchDaemons that masquerade as Zoom, Google Keystone, Teams or Finder
- Restrict installation of software from unverified disk images, pkg files and pirated sources
- Train staff on Discord, email and fake-job/fake-app social engineering aimed at crypto and finance staff
Timeline of The Mac Malware of 2023
- The 3CX Desktop App supply-chain compromise (SmoothOperator) became public; the trojanized macOS app was signed by 3CX and notarized by Apple.
- Objective-See published analysis of the macOS 3CX components: libffmpeg.dylib stage 1 and UpdateAgent stage 2.
- RustBucket, a BlueNoroff multi-stage backdoor delivered through a fake PDF viewer, was publicly reported (Jamf).
- JumpCloud disclosed a DPRK-attributed compromise; its commands framework was abused to deliver an init.rb Ruby script that fetched FullHouse.Doored, StratoFear and TieDye payloads.
- Elastic reported KandyKorn, a DPRK macOS backdoor delivered to crypto engineers over Discord, which hijacks Discord.app execution flow through HLOADER.
- Objective-See published 'The Mac Malware of 2023', cataloging ransomware, stealers and APT malware discovered during the year.
Sources cited for The Mac Malware of 2023
Detection coverage for TL-2026-4895
As of 2026-10-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4895 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.