GravityRAT spyware ports to macOS

Researchers dissected macOS variants of GravityRAT spyware, disguised as secure file-sharing apps, that root the Mac and persist via cron jobs.

Objective-See expanded on Kaspersky's discovery that GravityRAT, a cross-platform spyware historically used against the Indian armed forces, now has native macOS builds. Four unsigned Mach-O samples (Enigma, OrangeVault, StrongBox, TeraSpace) were obtained, all packaged with PyInstaller from Python source, masquerading as a secure file-sharing/anti-ransomware utility distributed from enigma.net.in.

The analysis traced the malware's execution chain: on first run without root, it drops a helper app bundle containing a compiled AppleScript that prompts the user for administrator credentials, relaunching the malware with root privileges via `do shell script ... with administrator privileges`. Once elevated, the malware fingerprints the host (product name, board ID, model) and beacons to a hardcoded C2 endpoint (download.enigma.net.in). It also checks for Full Disk Access by probing ~/Library/Safari and, if missing, prompts the user to manually grant Terminal.app that permission — a technique for bypassing macOS TCC protections through social engineering rather than exploitation.

For persistence, the malware installs a cron job (`*/2 * * * *`) via `sudo crontab` to execute a downloaded second-stage payload, which was not recovered in this investigation. Most of the compiled Python and UI code was legitimate-looking, intended to keep victims unaware the application is malicious. The behavior is detectable by monitoring tools such as BlockBlock that flag cronjob persistence.

Source reporting: https://objective-see.org/blog/blog_0x5B.html