DazzleSpy malware hits HK pro-democracy Mac users
ESET-discovered macOS spyware DazzleSpy was delivered via a compromised Hong Kong radio station website to spy on pro-democracy visitors.
Sourceobjective-see.org — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2019-8526 as exploited in the wild.
Researchers at ESET uncovered a watering-hole campaign in which a Hong Kong pro-democracy radio station's website was compromised to serve a WebKit/Safari exploit chain that silently installed a new macOS espionage implant dubbed DazzleSpy. Objective-See's analysis of the sample confirms the malware persists via a LaunchAgent (~/Library/LaunchAgents/com.apple.softwareupdate.plist) that relaunches the binary from ~/.local/softwareupdate, and communicates with a hardcoded C2 server at 88.218.192.128:5633.
Class-dump and disassembly reveal a full-featured cyber-espionage toolset: host survey (hardware/serial/OS version collection), file search by extension (targeting office documents), remote command execution, self-deletion, full interactive remote desktop via AVFoundation-based screen/video capture, and keychain dumping — the latter reportedly leveraging CVE-2019-8526, a keychain access flaw disclosed by researcher Linus Henze. The malware is an unsigned x86_64 Mach-O binary that runs under Rosetta2 on Apple Silicon.
Objective-See demonstrated that its free tools — BlockBlock (persistence detection), LuLu (outbound firewall), and KnockKnock (persistence scanner) — all detect DazzleSpy's activity without prior signatures, underscoring the value of behavioral detection against targeted implants like this one.
Mentioned in this report
Detection guidance
LaunchAgent Persistence via Unsigned Mach-O Binary
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detection of unsigned Mach-O binaries persisted through LaunchAgent plist in ~/Library/LaunchAgents, characteristic of DazzleSpy and similar targeted macOS implants. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: LaunchAgent Persistence via Unsigned Mach-O Binary
description: Detects creation of LaunchAgent plist files in ~/Library/LaunchAgents
that reference unsigned or suspiciously-located Mach-O binaries (e.g., ~/.local/),
a persistence mechanism used by DazzleSpy and similar targeted malware.
tags:
- attack.persistence
- attack.t1543.001
logsource:
category: file_event
product: macos
detection:
selection:
TargetFilename|contains: Library/LaunchAgents
TargetFilename|endswith: .plist
filter_system_agents:
TargetFilename|contains:
- /Library/LaunchAgents/com.apple.
- /Library/LaunchAgents/com.google.
- /Library/LaunchAgents/com.microsoft.
filter_known_benign:
TargetFilename|contains:
- Dropbox
- 1Password
- Alfred
condition: selection and not filter_system_agents and not filter_known_benign
falsepositives:
- Legitimate third-party applications installing LaunchAgents for legitimate background
services
- System utilities and maintenance tools adding persistence agents
level: medium
id: e04fe74b-187a-5ce4-bf62-2823a724c771
status: experimental
author: Vorant
Keychain Data Extraction via Security Framework
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Unsigned or suspicious process invoking macOS Security framework APIs to dump or enumerate keychain credentials, consistent with DazzleSpy keychain harvesting. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Keychain Data Extraction via Security Framework
description: Detects process execution that invokes keychain access routines (SecItemCopyMatching,
SecKeychainItemCopyContent) typically used by credential-stealing malware. DazzleSpy
and similar implants use these APIs to harvest stored passwords and certificates.
tags:
- attack.credential-access
- attack.t1555.001
logsource:
category: process_creation
product: macos
detection:
selection:
Image|endswith:
- .local/softwareupdate
- /tmp/
- /var/tmp/
CommandLine|contains:
- SecItemCopyMatching
- SecKeychainItemCopyContent
- security find-generic-password
- security dump-keychain
filter_legitimate_tools:
Image|contains:
- Xcode
- /usr/bin/security
condition: selection and not filter_legitimate_tools
falsepositives:
- Legitimate password managers querying keychain during credential sync
- Apple system processes performing routine keychain maintenance
level: high
id: 0f61cb1d-4de5-5bb6-9f2a-ff7b71c7b0dc
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://objective-see.org/blog/blog_0x6D.html
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the CVEs and malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,570 reports from 147 sources, 725 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs