Coldroot macOS RAT evades all antivirus engines

2 August 2026 routine threat

A cross-platform Pascal-written RAT called OSX/Coldroot persists as root, logs keystrokes, and streams desktops while going undetected by every VirusTotal AV engine.

Objective-See researcher Patrick Wardle discovered an undetected macOS sample, disguised as "com.apple.audio.driver.app," that referenced the TCC.db privacy database — a strong indicator of malicious intent since legitimate code has no reason to touch it. Analysis revealed the malware, dubbed OSX/Coldroot, is a UPX-packed, Pascal-compiled cross-platform remote access trojan that masquerades as a document, tricks users into entering credentials via a fake authentication prompt, and uses those credentials via AuthorizationExecuteWithPrivileges to install itself as a root launch daemon for persistent, privileged execution.

Once installed, Coldroot attempts to grant itself macOS Accessibility permissions (successful only on pre-SIP systems) to enable system-wide keylogging via CoreGraphics event taps, logging captured keystrokes to a local file. It also beacons to a hardcoded C2 server, exfiltrating host survey data (OS version, username, architecture) in JSON, and supports a broad RAT command set including file operations, process listing/execution/kill, upload/download, active window enumeration, remote shutdown, and live remote-desktop screen streaming. The malware's protocol and builder were tied to source code and a demo video from an author using the handle "Coldzer0," who advertised the RAT as a commercial cross-platform remote admin tool with a stated 2017 release date.

Though not technically sophisticated, Coldroot was fully undetected by all AV engines on VirusTotal at time of analysis and had no XProtect signature, illustrating a lingering gap in macOS malware detection. The research was published alongside disclosure of a separate, now-patched macOS UI-spoofing vulnerability the author planned to present at SyScan360, but that flaw is not part of the Coldroot analysis itself.

Mentioned in this report

Threat actors Coldzer0

Malware OSX/Coldroot

Detection guidance

Suspicious Process Requesting TCC.db Access

ATT&CK T1548.001

Process attempting to read or access the TCC.db privacy database, which legitimate applications should never touch directly. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Process Requesting TCC.db Access
description: Detects processes attempting to access the TCC.db privacy database file.
  Legitimate macOS applications do not directly interact with TCC.db; this is a strong
  indicator of malicious intent or privilege escalation attempts.
tags:
- attack.privilege-escalation
- attack.t1548.001
logsource:
  category: file_event
  product: macos
detection:
  selection:
    TargetFilePath|contains: TCC.db
    EventType:
    - CreateKey
    - ReadFile
    - WriteFile
  filter_system_processes:
    Image|startswith:
    - /usr/bin/
    - /System/Library/
    - /Library/CoreServices/
  condition: selection and not filter_system_processes
falsepositives:
- macOS system components during privacy database maintenance
level: high
id: a456c1ee-ec17-5aa8-ae3b-5a8a46bf6d6a
status: experimental
author: Vorant

Suspicious Use of AuthorizationExecuteWithPrivileges

ATT&CK T1548.001

Non-system process invoking AuthorizationExecuteWithPrivileges to execute commands with elevated privileges, typical of persistence installation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Use of AuthorizationExecuteWithPrivileges
description: Detects invocation of AuthorizationExecuteWithPrivileges API by non-system
  processes to execute privileged commands. Malware frequently uses this mechanism
  to install root-level persistence such as launch daemons.
tags:
- attack.privilege-escalation
- attack.t1548.001
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    CommandLine|contains: AuthorizationExecuteWithPrivileges
  filter_apple_tools:
    Image|startswith:
    - /usr/bin/
    - /usr/sbin/
    - /System/Library/
  filter_legitimate_admin:
    ParentImage|startswith:
    - /Applications/Utilities/
    - /Library/CoreServices/
  condition: selection and not (filter_apple_tools or filter_legitimate_admin)
falsepositives:
- Legitimate system administration tools requesting elevated execution
- macOS setup assistants
level: high
id: 5a3712cf-9762-5d6e-aaf3-a774e6df9fcc
status: experimental
author: Vorant

Launch Daemon Creation by Non-System Process

ATT&CK T1543.004

Non-root process writing or modifying property list files in the /Library/LaunchDaemons or /var/db/launchd.d directories to establish persistence. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Launch Daemon Creation by Non-System Process
description: Detects suspicious creation or modification of launch daemon configuration
  files (.plist) in system directories by non-system processes. This is the primary
  persistence mechanism for macOS malware seeking to survive reboot with elevated
  privileges.
tags:
- attack.persistence
- attack.t1543.004
logsource:
  category: file_event
  product: macos
detection:
  selection:
    TargetFilePath|contains:
    - /Library/LaunchDaemons/
    - /var/db/launchd.d/
    TargetFilePath|endswith: .plist
    EventType:
    - CreateFile
    - WriteFile
  filter_apple_installers:
    Image|startswith:
    - /usr/libexec/
    - /System/Library/
  filter_legitimate_packages:
    Image|contains:
    - installer
    - package
  condition: selection and not (filter_apple_installers or filter_legitimate_packages)
falsepositives:
- Software installation tools writing daemon configurations
- System administrators manually configuring launch daemons
level: medium
id: 7279736d-1a0b-55aa-bac4-e2c0bc24a08e
status: experimental
author: Vorant

1 more detection artefacts for this report (IOC-atomic rules, Splunk/KQL/Elastic conversions, YARA, Suricata) are available to subscribers.

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://objective-see.org/blog/blog_0x2A.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free