VORANT. Threat Intelligence Sign in Get the full feed

DazzleSpy malware hits HK pro-democracy Mac users

elevated threat media

ESET-discovered macOS spyware DazzleSpy was delivered via a compromised Hong Kong radio station website to spy on pro-democracy visitors.

Researchers at ESET uncovered a watering-hole campaign in which a Hong Kong pro-democracy radio station's website was compromised to serve a WebKit/Safari exploit chain that silently installed a new macOS espionage implant dubbed DazzleSpy. Objective-See's analysis of the sample confirms the malware persists via a LaunchAgent (~/Library/LaunchAgents/com.apple.softwareupdate.plist) that relaunches the binary from ~/.local/softwareupdate, and communicates with a hardcoded C2 server at 88.218.192.128:5633.

Class-dump and disassembly reveal a full-featured cyber-espionage toolset: host survey (hardware/serial/OS version collection), file search by extension (targeting office documents), remote command execution, self-deletion, full interactive remote desktop via AVFoundation-based screen/video capture, and keychain dumping — the latter reportedly leveraging CVE-2019-8526, a keychain access flaw disclosed by researcher Linus Henze. The malware is an unsigned x86_64 Mach-O binary that runs under Rosetta2 on Apple Silicon.

Objective-See demonstrated that its free tools — BlockBlock (persistence detection), LuLu (outbound firewall), and KnockKnock (persistence scanner) — all detect DazzleSpy's activity without prior signatures, underscoring the value of behavioral detection against targeted implants like this one.

Mentioned in this report

Vulnerabilities CVE-2019-8526KEV
Malware DazzleSpy

Detection guidance

LaunchAgent Persistence via Unsigned Mach-O Binary

ATT&CK T1543.001

Detection of unsigned Mach-O binaries persisted through LaunchAgent plist in ~/Library/LaunchAgents, characteristic of DazzleSpy and similar targeted macOS implants. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: LaunchAgent Persistence via Unsigned Mach-O Binary
description: Detects creation of LaunchAgent plist files in ~/Library/LaunchAgents
  that reference unsigned or suspiciously-located Mach-O binaries (e.g., ~/.local/),
  a persistence mechanism used by DazzleSpy and similar targeted malware.
tags:
- attack.persistence
- attack.t1543.001
logsource:
  category: file_event
  product: macos
detection:
  selection:
    TargetFilename|contains: Library/LaunchAgents
    TargetFilename|endswith: .plist
  filter_system_agents:
    TargetFilename|contains:
    - /Library/LaunchAgents/com.apple.
    - /Library/LaunchAgents/com.google.
    - /Library/LaunchAgents/com.microsoft.
  filter_known_benign:
    TargetFilename|contains:
    - Dropbox
    - 1Password
    - Alfred
  condition: selection and not filter_system_agents and not filter_known_benign
falsepositives:
- Legitimate third-party applications installing LaunchAgents for legitimate background
  services
- System utilities and maintenance tools adding persistence agents
level: medium
id: e04fe74b-187a-5ce4-bf62-2823a724c771
status: experimental
author: Vorant

Keychain Data Extraction via Security Framework

ATT&CK T1555.001

Unsigned or suspicious process invoking macOS Security framework APIs to dump or enumerate keychain credentials, consistent with DazzleSpy keychain harvesting. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Keychain Data Extraction via Security Framework
description: Detects process execution that invokes keychain access routines (SecItemCopyMatching,
  SecKeychainItemCopyContent) typically used by credential-stealing malware. DazzleSpy
  and similar implants use these APIs to harvest stored passwords and certificates.
tags:
- attack.credential-access
- attack.t1555.001
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    Image|endswith:
    - .local/softwareupdate
    - /tmp/
    - /var/tmp/
    CommandLine|contains:
    - SecItemCopyMatching
    - SecKeychainItemCopyContent
    - security find-generic-password
    - security dump-keychain
  filter_legitimate_tools:
    Image|contains:
    - Xcode
    - /usr/bin/security
  condition: selection and not filter_legitimate_tools
falsepositives:
- Legitimate password managers querying keychain during credential sync
- Apple system processes performing routine keychain maintenance
level: high
id: 0f61cb1d-4de5-5bb6-9f2a-ff7b71c7b0dc
status: experimental
author: Vorant

Screen Capture via AVFoundation in Unsigned Process

ATT&CK T1113

Unsigned Mach-O process using AVFoundation framework for screen/video capture without user interaction, typical of DazzleSpy remote desktop capability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Screen Capture via AVFoundation in Unsigned Process
description: Detects unsigned or suspicious processes loading AVFoundation framework
  and capturing screen/video content, a technique used by DazzleSpy for interactive
  remote desktop surveillance.
tags:
- attack.collection
- attack.t1113
logsource:
  category: image_load
  product: macos
detection:
  selection:
    Image|endswith:
    - .local/softwareupdate
    - /tmp/
    - /var/tmp/
    ImageLoaded|contains: AVFoundation.framework
  filter_legitimate_media:
    Image|contains:
    - QuickTime
    - ScreenFlow
    - OBS
    - Zoom
  condition: selection and not filter_legitimate_media
falsepositives:
- Legitimate screen-recording and video-conferencing applications
- Development tools testing multimedia capture
level: high
id: 88796a8e-1adc-56d1-b4c5-47b0a3b140c9
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://objective-see.org/blog/blog_0x6D.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free