BeaverTail Malware Gets Native macOS Variant

15 June 2024 routine threat

DPRK hackers disguised a native macOS BeaverTail stealer as a cloned MiroTalk video-call app to steal browser/crypto-wallet data and deploy the InvisibleFerret backdoor.

Objective-See analyzed a previously undetected macOS disk image, MiroTalk.dmg, distributed from a fake clone of the legitimate MiroTalk video-conferencing site (mirotalk.net vs. the real meet.no42.org). The unsigned application, internally named "Jami" and built with Qt/QMake, is a native (Mach-O) port of BeaverTail, a JavaScript-based stealer previously documented by Palo Alto Networks Unit42 in DPRK-linked "fake job interview" social-engineering campaigns. The malware harvests macOS Keychain data, browser profile/Local State files from Chrome, Brave and Opera, and targets numerous cryptocurrency wallet browser extensions, exfiltrating the data to a hardcoded C2 at 95.164.17.24:1224.

Beyond credential and wallet theft, the malware fetches additional Python-based payloads from the same C2 via endpoints (/uploads, /pdown, /client/99) matching those Unit42 previously tied to BeaverTail's JavaScript variant. One retrieved payload is a cross-platform Python downloader/executor, and another matches InvisibleFerret, a fully-featured cross-platform backdoor also attributed to the same DPRK operation. The C2 server has been previously flagged as North Korean infrastructure.

The campaign relies on social engineering — luring victims, likely job seekers or those solicited for fake hiring/interview meetings, into running the malicious "MiroTalk" app — rather than any novel exploit. Objective-See notes its free tools BlockBlock (Notarization Mode) and LuLu can respectively block execution of the unnotarized binary and alert on its outbound C2 connection, providing detection even without prior signature knowledge.

Mentioned in this report

Threat actors North Korea-nexus activity (unattributed)

Malware BeaverTailInvisibleFerret

Campaigns Contagious Interview

Detection guidance

Unsigned Mach-O Application Accessing macOS Keychain

ATT&CK T1555

Detects unsigned or ad-hoc signed Mach-O binaries spawning security_agent or accessing Keychain databases—typical credential theft on macOS. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Unsigned Mach-O Application Accessing macOS Keychain
description: Detects unsigned or ad-hoc signed executables (common in malware distribution
  via DMG) spawning security_agent process or directly accessing Keychain credential
  stores. This matches the BeaverTail macOS variant harvesting login credentials.
tags:
- attack.credential-access
- attack.t1555
logsource:
  category: process_creation
  product: macos
detection:
  selection_keychain_access:
    Image|endswith:
    - /security_agent
    ParentImage|contains:
    - /Volumes/
    CommandLine|contains: Keychain
  selection_unsigned_binary:
    ParentImage|endswith:
    - .app/Contents/MacOS
    Image|endswith:
    - /security_agent
  filter_system:
    ParentImage|contains:
    - /System/Library/
    - /usr/libexec/
  condition: (selection_keychain_access or selection_unsigned_binary) and not filter_system
falsepositives:
- Legitimate third-party password managers accessing Keychain during sync
- System UI processes requesting Keychain authorization prompts
level: high
id: a887b05c-d64e-5cad-9a91-5029d2611be0
status: experimental
author: Vorant

Native macOS Binary Exfiltrating Browser Profile Data

ATT&CK T1005

Detects Mach-O processes reading Chrome/Brave/Opera Local State and profile directories, then connecting to external hosts—indicative of browser credential/wallet theft. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Native macOS Binary Exfiltrating Browser Profile Data
description: Detects unsigned/unnotarized macOS applications reading Chrome, Brave,
  and Opera profile directories (Local State, Login Data, Local Extension Settings)
  followed by network connections to non-RFC1918 destinations. Matches BeaverTail
  harvesting cryptocurrency wallet extensions and browser credentials.
tags:
- attack.exfiltration
- attack.t1005
- attack.t1041
logsource:
  category: file_event
  product: macos
detection:
  selection_browser_access:
    Image|endswith:
    - .app/Contents/MacOS
    TargetFilePath|contains:
    - /Library/Application Support/Google/Chrome/Default/Local State
    - /Library/Application Support/BraveSoftware/Brave-Browser/Default/Local State
    - /Library/Application Support/com.operasoftware.Opera/Local Extension Settings
  filter_system:
    Image|contains:
    - /System/
    - /Applications/Google Chrome.app
    - /Applications/Brave Browser.app
  condition: selection_browser_access and not filter_system
falsepositives:
- Password managers (1Password, Bitwarden) legitimately reading browser profiles for
  import
- Browser sync services accessing Local State for settings replication
level: high
id: 3cd6783b-e249-5023-9805-406c3df31aa6
status: experimental
author: Vorant

1 more detection artefacts for this report (IOC-atomic rules, Splunk/KQL/Elastic conversions, YARA, Suricata) are available to subscribers.

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://objective-see.org/blog/blog_0x7A.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free