Threat reportMalwareTL-2026-4905
The Mac Malware of 2025: Objective-See review of macOS infostealers (DigitStealer, Phexia, Paradox, Koi, MacSync, RN Stealer, AMOS variants), ChillyHell/NightPaw backdoors and DPRK-linked campaigns
The Mac Malware of 2025 (TL-2026-4905), also tracked as Mac Malware of 2025, is a high-severity malware campaign, first published 2026-10-31. It is attributed to UNC4487 (North Korea) with medium confidence, affects Apple macOS, maps to 23 MITRE ATT&CK techniques (T1036.005, T1056.001, T1056.002), and is covered by 9 detection rules and 28 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 23MITRE ATT&CK
- Actors
- 1UNC4487
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 28Indicators of compromise
Key facts for TL-2026-4905
- Threat ID
- TL-2026-4905
- Also known as
- Mac Malware of 2025, Objective-See MacMalware 2025
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution
- UNC4487
- Attribution confidence
- MEDIUM
- Nation-state nexus
- North Korea
- Motivation
- FINANCIAL
- Target sectors
- cryptocurrency, technology, software development, finance, government administration, general consumer
- Target regions
- Global, North America, Europe, ukraine
- Detection rules
- 9
- Indicators of compromise
- 28
Malware and tooling in The Mac Malware of 2025
Malware and tooling: AMOS, FlexibleFerret, FrigidStealer, Koi Stealer, Odyssey Stealer, Paradox, RN Stealer, SocGholish - S1124
How The Mac Malware of 2025 works
Objective-See's annual review of new macOS malware in 2025 finds infostealers the dominant class, delivered through fake apps, ClickFix, malvertising, fake job interviews and a backdoored Cursor IDE extension. It also covers backdoors such as ChillyHell (UNC4487) and NightPaw, plus DPRK-linked Koi Stealer, RN Stealer, FlexibleFerret and BlueNoroff toolsets.
Objective-See (Patrick Wardle) catalogues the new macOS malware of 2025. Stealers dominate: Kitty (in development, hardcoded localhost C2, targets Chrome Safe Storage and Exodus), DigitStealer (fake DynamicLake DMG; Launch Agent goldenticketsshop.com.plist; DNS TXT C2 via 'dig +short TXT goldenticketsshop.com @8.8.8.8'; JXA/AppleScript payloads; geofencing that skips ru, ua, by, am, az, kz, kg, md, tj, uz, ge; a Ledger Live backdoor beaconing to sweetseedsbeep.com:8118), Phexia (malvertising/MaaS; dead-drop resolvers on Telegram and Steam; AppleScript backdoor harvesting passwords), Paradox Stealer (delivered via the backdoored ether.solidity Cursor IDE extension on Open VSX, 117k+ downloads; two-stage JavaScript run via vm.runInContext from function.undefined21.com), Koi Stealer (DPRK-linked per Unit 42; fake job interviews and Visual Studio projects; C2 5.255.101.148), Frigid Stealer (fake update pages; askforupdate.org; TA2726/TA2727 per Proofpoint), MacSync (fake zk-Call & Messenger DMG, ClickFix, later code-signed and notarized Swift variants, AppleScript stealer plus Go backdoor polling brsp.meshsorterio.com every 30s/5s) and RN Stealer (Slow Pisces fake LinkedIn recruiting; Python loader, YAML deserialization, XOR-encrypted ZIP exfiltration of keychain, .ssh, .aws, .kube and gcloud configs).
Backdoors include ChillyHell, a modular C++ Intel backdoor that Mandiant attributes to UNC4487 (targeting Ukrainian officials). Per Jamf it was Apple-notarized in 2021 and persists via a Launch Agent/Daemon named com.apple.qtop.plist, shell-profile injection and timestomping, and carries reverse-shell, updater, loader and Kerberos-focused password-cracking modules. NightPaw is an ad hoc signed x86_64 backdoor that spoofs Apple process names, sends the User-Agent com.apple.trustd/2.0, takes a screenshot every 5 minutes and uses /api/v1/telemetry.
The review also notes DPRK investment in social-engineering campaigns: BlueNoroff's fake-Zoom AppleScript chain (Telegram 2, Root Troy V4, InjectWithDyld, keylogger, CryptoBot) and FlexibleFerret (Contagious Interview, Go backdoor). Other items are PasivRobber (Chinese surveillance tooling), Odyssey Stealer (AMOS fork, poseidon.cool), SHAMOS (AMOS variant attributed to COOKIE SPIDER by CrowdStrike, ClickFix), a fake-CAPTCHA stealer (82.115.223.9), JSCoreRunner, AdLoad, MioLab and Zuru. The common theme is increasingly sophisticated multi-stage attacks that abuse user-driven execution rather than exploits. The article lists no CVEs and states no CVSS score or severity; severity here is an analyst judgment. The article's publication date could not be verified, so first_disclosed is null.
MITRE ATT&CK techniques used in TL-2026-4905
Defense Evasion
T1036.005 Match Legitimate Resource Name or Location; T1070.006 Timestomp; T1480 Execution Guardrails; T1564.001 Hidden Files and Directories
Credential Access
T1056.001 Keylogging; T1056.002 GUI Input Capture; T1110.002 Password Cracking; T1539 Steal Web Session Cookie; T1555.001 Keychain; T1555.003 Credentials from Web Browsers
Execution
T1059.002 AppleScript; T1059.004 Unix Shell; T1059.007 JavaScript; T1204.002 Malicious File
Command and Control
T1071.001 Web Protocols; T1071.004 DNS; T1102.001 Dead Drop Resolver
Collection
Initial Access
T1195.002 Compromise Software Supply Chain
Persistence
T1543.001 Launch Agent; T1543.004 Launch Daemon; T1546.004 Unix Shell Configuration Modification
defense-impairment
Affected products and versions in The Mac Malware of 2025
- Apple — macOS
Vulnerable versions: Users running affected macOS versions who execute malicious DMG/PKG, script, extension or terminal-pasted commands - Anysphere / Open VSX — Cursor IDE extension ether.solidity
Vulnerable versions: ether.solidity (malicious extension)
Remediation for The Mac Malware of 2025
Patches
- No CVE or vendor patch applies; these are user-executed malware families. Keep macOS and XProtect/MRT definitions current.
Immediate actions
- Block the network IOCs listed (domains and IPs) at DNS, proxy and firewall layers
- Hunt endpoints for Launch Agents/Daemons named com.apple.qtop.plist, goldenticketsshop.com.plist, com.telegram2.update.agent.plist and us.zoom.ZoomDaemon.plist
- Audit installed Cursor/VS Code extensions and remove ether.solidity
- Rotate browser-stored credentials, SSH keys, cloud tokens and crypto wallet seeds on any host that ran an unverified app, script or terminal command
Workarounds
- Block osascript and curl-to-shell execution from untrusted parent processes where feasible
- Disable user override of Gatekeeper on managed Macs
- Revoke or monitor third-party developer Team IDs F645668Q3H and R868N47FV5 in MDM allowlists
Longer-term hardening
- Deploy macOS EDR with Endpoint Security Framework telemetry for LaunchAgent/LaunchDaemon creation, osascript/JXA execution and quarantine-attribute removal
- Train developers and staff on ClickFix, fake-update and fake job-interview lures, including never pasting commands from web pages into Terminal
- Restrict IDE extension installation to an allowlist and enforce Gatekeeper/notarization checks without user override
- Store cloud and SSH credentials in hardware-backed or short-lived form to limit stealer impact
Timeline of The Mac Malware of 2025
- ChillyHell samples are developer-signed and notarized by Apple in 2021 (Jamf); exact day unknown, so the first of the year is used.
- Mandiant tracks UNC4487, activity from 2022-2023 targeting Ukrainian officials, and links it to ChillyHell (Jamf/THN); exact day unknown, so the first of the year is used.
- g0njxa reports a macOS fake-CAPTCHA stealer using 82.115.223.9/contact for C2.
- Odyssey Stealer, an AMOS fork using poseidon.cool and staging in /tmp/pizda/, is reported (MarceloRivero).
- Unit 42 publishes the first macOS Koi Stealer and RustDoor analysis in DPRK fake job interview campaigns (C2 5.255.101.148).
- A new ChillyHell sample ('applet') is discovered in May 2025 (Jamf); exact day unknown.
- Moonlock Lab reports a new AMOS variant with persistent backdoor capability.
- SentinelOne reports Zuru resurfacing with a modified Khepri beacon and trojanized apps.
- Mosyle/9to5Mac report JSCoreRunner, a fake PDF converter hijacking browser search.
- Jamf Threat Labs publicly discloses and names ChillyHell, with coverage by The Hacker News in September 2025; exact day unknown.
Sources cited for The Mac Malware of 2025
- The Mac Malware of 2025 (Objective-See, Patrick Wardle)
- Mac Malware of 2025 (PDF report)
- Objective-See Malware collection (samples)
- RustDoor and Koi Stealer for macOS Used by North Korea-Linked Threat Actor (Unit 42)
- Slow Pisces new custom malware (Unit 42)
- ChillyHell: A Deep Dive into a Modular macOS Backdoor (Jamf)
- ChillyHell macOS backdoor and ZynorRAT (The Hacker News)
- DigitStealer macOS infostealer analysis (Jamf)
- MacSync stealer evolution: code-signed Swift malware (Jamf)
- MacSync stealer and backdoor (Moonlock)
- Paradox Stealer in Solidity Open VSX extension attack (Phorion)
- Update: Fake updates, two new actors and new Mac malware (Proofpoint)
- Fully undetectable (FUD) macOS backdoor (NightPaw)
Detection coverage for TL-2026-4905
As of 2026-10-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4905 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.