MapperState malware targets Apple M1 Macs
Confiant found MapperState, a new ARM-native downloader tied to OSX/Tarmac and Hydromac, delivered via malvertising to notarized Apple M1 Macs.
Confiant researchers discovered a new macOS malware sample, dubbed MapperState, delivered to their honeypot via malvertising through the OSX/Bundlore loader and OSX/Tarmac dropper. Notably, MapperState was compiled for ARM64 and notarized by Apple, making it compatible with the new M1 MacBooks. The malware uses heavy string encryption and anti-analysis tricks—198 duplicated decryption code blocks—to slow reverse engineering, requiring Confiant to emulate the routines with Unicorn Engine and custom IDAPython tooling to extract the encrypted command strings.
Analysis revealed MapperState functions as a Hydromac Root Agent (HM_RA), a simple downloader capable of retrieving and executing further payloads and checking installed AV products, though the C2 server (mapperstate[.]com) returned empty content during investigation, so the final payload was not observed. Confiant traced command naming and functionality overlaps between MapperState, older OSX/Tarmac samples (2019), a related Hydromac Agent sample communicating with a C2 previously tied to the 2017 Mughthesec malware (documented by Patrick Wardle), and public flashcard app entries created by an individual whose OPSEC mistakes exposed personal details and links to a Facebook-ads-renting scheme called "CashWithFB."
The findings suggest a long-running, evolving malvertising-driven malware lineage (Mughthesec → Tarmac → Hydromac/MapperState) targeting macOS users, with a possible but unconfirmed link between the leaker of command details and malvertising affiliate operations. Confiant explicitly declines to make firm individual-level attribution, leaving that to other organizations, while noting the malware is actively evolving to counter analysis tools.
Mentioned in this report
Detection guidance
Process Executing Heavily Obfuscated/Duplicated Code Blocks
Process spawning child processes or loading libraries with repetitive, near-identical code sequences indicative of anti-analysis string decryption obfuscation patterns. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Process Executing Heavily Obfuscated Code Patterns
description: Detects execution of processes with command lines or loaded images containing
suspicious patterns of code obfuscation - such as repeated decryption routine invocation,
heavy use of string encoding/XOR chains, or multiple identical subroutine calls
designed to defeat static analysis. This generalises on the behavioural pattern
of duplicated decryption logic rather than specific strings.
tags:
- attack.defense-evasion
- attack.t1027
logsource:
category: image_load
product: macos
detection:
selection:
Image|contains:
- /tmp/
- /var/tmp/
- /var/folders
CommandLine|re: (decrypt|decode|deobfuscate|xor|rot|cipher).*\1.*\1
filter_development:
Image|contains:
- /Applications/Xcode
- /Library/Developer
condition: selection and not filter_development
falsepositives:
- Legitimate security tools performing signature analysis or malware detection with
repeated decode loops
- Custom build systems or CI/CD runners executing compiler-generated obfuscated binaries
level: medium
id: d538a974-97d8-5ec1-8531-f0cad0a9d0f1
status: experimental
author: Vorant
2 more detection artefacts for this report (IOC-atomic rules, Splunk/KQL/Elastic conversions, YARA, Suricata) are available to subscribers.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://objective-see.org/blog/blog_0x65.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free