MapperState malware targets Apple M1 Macs
Confiant found MapperState, a new ARM-native downloader tied to OSX/Tarmac and Hydromac, delivered via malvertising to notarized Apple M1 Macs.
Sourceobjective-see.org — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
Confiant researchers discovered a new macOS malware sample, dubbed MapperState, delivered to their honeypot via malvertising through the OSX/Bundlore loader and OSX/Tarmac dropper. Notably, MapperState was compiled for ARM64 and notarized by Apple, making it compatible with the new M1 MacBooks. The malware uses heavy string encryption and anti-analysis tricks—198 duplicated decryption code blocks—to slow reverse engineering, requiring Confiant to emulate the routines with Unicorn Engine and custom IDAPython tooling to extract the encrypted command strings.
Analysis revealed MapperState functions as a Hydromac Root Agent (HM_RA), a simple downloader capable of retrieving and executing further payloads and checking installed AV products, though the C2 server (mapperstate[.]com) returned empty content during investigation, so the final payload was not observed. Confiant traced command naming and functionality overlaps between MapperState, older OSX/Tarmac samples (2019), a related Hydromac Agent sample communicating with a C2 previously tied to the 2017 Mughthesec malware (documented by Patrick Wardle), and public flashcard app entries created by an individual whose OPSEC mistakes exposed personal details and links to a Facebook-ads-renting scheme called "CashWithFB."
The findings suggest a long-running, evolving malvertising-driven malware lineage (Mughthesec → Tarmac → Hydromac/MapperState) targeting macOS users, with a possible but unconfirmed link between the leaker of command details and malvertising affiliate operations. Confiant explicitly declines to make firm individual-level attribution, leaving that to other organizations, while noting the malware is actively evolving to counter analysis tools.
Mentioned in this report
Detection guidance
2 detections for this report are in the app — indicator rules, each with Sigma, Splunk SPL, and Elastic, some with Microsoft Defender XDR KQL, YARA, or Suricata as well. Free account, no card.
Source reporting: https://objective-see.org/blog/blog_0x65.html
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs