# The Mac Malware of 2025: Objective-See review of macOS infostealers (DigitStealer, Phexia, Paradox, Koi, MacSync, RN Stealer, AMOS variants), ChillyHell/NightPaw backdoors and DPRK-linked campaigns

> Objective-See's annual review of new macOS malware in 2025 finds infostealers the dominant class, delivered through fake apps, ClickFix, malvertising, fake job interviews and a backdoored Cursor IDE extension. It also covers backdoors such as ChillyHell (UNC4487) and NightPaw, plus DPRK-linked Koi Stealer, RN Stealer, FlexibleFerret and BlueNoroff toolsets.

- **Published:** 2026-10-31T14:00:03Z
- **Last reviewed:** 2026-10-31T14:00:03Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4905
- **ID:** TL-2026-4905
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** UNC4487 (North Korea)
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Objective-See (Patrick Wardle) catalogues the new macOS malware of 2025. Stealers dominate: Kitty (in development, hardcoded localhost C2, targets Chrome Safe Storage and Exodus), DigitStealer (fake DynamicLake DMG; Launch Agent goldenticketsshop.com.plist; DNS TXT C2 via 'dig +short TXT goldenticketsshop.com @8.8.8.8'; JXA/AppleScript payloads; geofencing that skips ru, ua, by, am, az, kz, kg, md, tj, uz, ge; a Ledger Live backdoor beaconing to sweetseedsbeep.com:8118), Phexia (malvertising/MaaS; dead-drop resolvers on Telegram and Steam; AppleScript backdoor harvesting passwords), Paradox Stealer (delivered via the backdoored ether.solidity Cursor IDE extension on Open VSX, 117k+ downloads; two-stage JavaScript run via vm.runInContext from function.undefined21.com), Koi Stealer (DPRK-linked per Unit 42; fake job interviews and Visual Studio projects; C2 5.255.101.148), Frigid Stealer (fake update pages; askforupdate.org; TA2726/TA2727 per Proofpoint), MacSync (fake zk-Call & Messenger DMG, ClickFix, later code-signed and notarized Swift variants, AppleScript stealer plus Go backdoor polling brsp.meshsorterio.com every 30s/5s) and RN Stealer (Slow Pisces fake LinkedIn recruiting; Python loader, YAML deserialization, XOR-encrypted ZIP exfiltration of keychain, .ssh, .aws, .kube and gcloud configs).

Backdoors include ChillyHell, a modular C++ Intel backdoor that Mandiant attributes to UNC4487 (targeting Ukrainian officials). Per Jamf it was Apple-notarized in 2021 and persists via a Launch Agent/Daemon named com.apple.qtop.plist, shell-profile injection and timestomping, and carries reverse-shell, updater, loader and Kerberos-focused password-cracking modules. NightPaw is an ad hoc signed x86_64 backdoor that spoofs Apple process names, sends the User-Agent com.apple.trustd/2.0, takes a screenshot every 5 minutes and uses /api/v1/telemetry.

The review also notes DPRK investment in social-engineering campaigns: BlueNoroff's fake-Zoom AppleScript chain (Telegram 2, Root Troy V4, InjectWithDyld, keylogger, CryptoBot) and FlexibleFerret (Contagious Interview, Go backdoor). Other items are PasivRobber (Chinese surveillance tooling), Odyssey Stealer (AMOS fork, poseidon.cool), SHAMOS (AMOS variant attributed to COOKIE SPIDER by CrowdStrike, ClickFix), a fake-CAPTCHA stealer (82.115.223.9), JSCoreRunner, AdLoad, MioLab and Zuru. The common theme is increasingly sophisticated multi-stage attacks that abuse user-driven execution rather than exploits. The article lists no CVEs and states no CVSS score or severity; severity here is an analyst judgment. The article's publication date could not be verified, so first_disclosed is null.

## MITRE ATT&CK

- T1195.002 Compromise Software Supply Chain
- T1204.002 Malicious File
- T1059.002 AppleScript
- T1059.007 JavaScript
- T1059.004 Unix Shell
- T1543.001 Launch Agent
- T1543.004 Launch Daemon
- T1546.004 Unix Shell Configuration Modification
- T1036.005 Match Legitimate Resource Name or Location
- T1553.001 Gatekeeper Bypass
- T1070.006 Timestomp
- T1564.001 Hidden Files and Directories
- T1480 Execution Guardrails
- T1555.001 Keychain
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1056.002 GUI Input Capture
- T1056.001 Keylogging
- T1110.002 Password Cracking
- T1113 Screen Capture
- T1102.001 Dead Drop Resolver
- T1071.001 Web Protocols
- T1071.004 DNS

## Sources

- [The Mac Malware of 2025 (Objective-See, Patrick Wardle)](https://objective-see.org/blog/blog_0x84.html)
- [Mac Malware of 2025 (PDF report)](https://objective-see.org/downloads/MacMalware_2025.pdf)
- [Objective-See Malware collection (samples)](https://github.com/objective-see/Malware)
- [RustDoor and Koi Stealer for macOS Used by North Korea-Linked Threat Actor (Unit 42)](https://unit42.paloaltonetworks.com/macos-malware-targets-crypto-sector/)
- [Slow Pisces new custom malware (Unit 42)](https://unit42.paloaltonetworks.com/slow-pisces-new-custom-malware/)
- [ChillyHell: A Deep Dive into a Modular macOS Backdoor (Jamf)](https://www.jamf.com/blog/chillyhell-a-modular-macos-backdoor/)
- [ChillyHell macOS backdoor and ZynorRAT (The Hacker News)](https://thehackernews.com/2025/09/chillyhell-macos-backdoor-and-zynorrat.html)
- [DigitStealer macOS infostealer analysis (Jamf)](https://www.jamf.com/blog/jtl-digitstealer-macos-infostealer-analysis/)
- [MacSync stealer evolution: code-signed Swift malware (Jamf)](https://www.jamf.com/blog/macsync-stealer-evolution-code-signed-swift-malware-analysis/)
- [MacSync stealer and backdoor (Moonlock)](https://moonlock.com/macc-stealer-macsync-backdoor)
- [Paradox Stealer in Solidity Open VSX extension attack (Phorion)](https://phorion.io/blog/macos-paradox-stealer-used-in-solidity-open-vsx-extension-attack/)
- [Update: Fake updates, two new actors and new Mac malware (Proofpoint)](https://www.proofpoint.com/us/blog/threat-insight/update-fake-updates-two-new-actors-and-new-mac-malware)
- [Fully undetectable (FUD) macOS backdoor (NightPaw)](https://denwp.com/fully-undetectable-fud-macos-backdoor/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4905