Coldroot macOS RAT evades all antivirus engines
A cross-platform Pascal-written RAT called OSX/Coldroot persists as root, logs keystrokes, and streams desktops while going undetected by every VirusTotal AV engine.
Sourceobjective-see.org — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
- Date
- The source gives no publication date; the date shown is the day Vorant added the brief.
Objective-See researcher Patrick Wardle discovered an undetected macOS sample, disguised as "com.apple.audio.driver.app," that referenced the TCC.db privacy database — a strong indicator of malicious intent since legitimate code has no reason to touch it. Analysis revealed the malware, dubbed OSX/Coldroot, is a UPX-packed, Pascal-compiled cross-platform remote access trojan that masquerades as a document, tricks users into entering credentials via a fake authentication prompt, and uses those credentials via AuthorizationExecuteWithPrivileges to install itself as a root launch daemon for persistent, privileged execution.
Once installed, Coldroot attempts to grant itself macOS Accessibility permissions (successful only on pre-SIP systems) to enable system-wide keylogging via CoreGraphics event taps, logging captured keystrokes to a local file. It also beacons to a hardcoded C2 server, exfiltrating host survey data (OS version, username, architecture) in JSON, and supports a broad RAT command set including file operations, process listing/execution/kill, upload/download, active window enumeration, remote shutdown, and live remote-desktop screen streaming. The malware's protocol and builder were tied to source code and a demo video from an author using the handle "Coldzer0," who advertised the RAT as a commercial cross-platform remote admin tool with a stated 2017 release date.
Though not technically sophisticated, Coldroot was fully undetected by all AV engines on VirusTotal at time of analysis and had no XProtect signature, illustrating a lingering gap in macOS malware detection. The research was published alongside disclosure of a separate, now-patched macOS UI-spoofing vulnerability the author planned to present at SyScan360, but that flaw is not part of the Coldroot analysis itself.
Mentioned in this report
Detection guidance
Suspicious Use of AuthorizationExecuteWithPrivileges
A behavioural hunt for the technique in general.
Non-system process invoking AuthorizationExecuteWithPrivileges to execute commands with elevated privileges, typical of persistence installation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Use of AuthorizationExecuteWithPrivileges
description: Detects invocation of AuthorizationExecuteWithPrivileges API by non-system
processes to execute privileged commands. Malware frequently uses this mechanism
to install root-level persistence such as launch daemons.
tags:
- attack.privilege-escalation
- attack.t1548.001
logsource:
category: process_creation
product: macos
detection:
selection:
CommandLine|contains: AuthorizationExecuteWithPrivileges
filter_apple_tools:
Image|startswith:
- /usr/bin/
- /usr/sbin/
- /System/Library/
filter_legitimate_admin:
ParentImage|startswith:
- /Applications/Utilities/
- /Library/CoreServices/
condition: selection and not (filter_apple_tools or filter_legitimate_admin)
falsepositives:
- Legitimate system administration tools requesting elevated execution
- macOS setup assistants
level: high
id: 5a3712cf-9762-5d6e-aaf3-a774e6df9fcc
status: experimental
author: Vorant
1 more detection for this report is in the app — an indicator rule with Sigma, Splunk SPL, Elastic, Microsoft Defender XDR KQL, and YARA. Free account, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://objective-see.org/blog/blog_0x2A.html
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the actors and malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs