BeaverTail Malware Gets Native macOS Variant

Published15 June 2024 Vorant ratingroutine threat

Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

DPRK hackers disguised a native macOS BeaverTail stealer as a cloned MiroTalk video-call app to steal browser/crypto-wallet data and deploy the InvisibleFerret backdoor.

Sourceobjective-see.org — open the original

What to check

Applies to: Whether this concerns you is not assessed; the names the report mentions are listed below.

Objective-See analyzed a previously undetected macOS disk image, MiroTalk.dmg, distributed from a fake clone of the legitimate MiroTalk video-conferencing site (mirotalk.net vs. the real meet.no42.org). The unsigned application, internally named "Jami" and built with Qt/QMake, is a native (Mach-O) port of BeaverTail, a JavaScript-based stealer previously documented by Palo Alto Networks Unit42 in DPRK-linked "fake job interview" social-engineering campaigns. The malware harvests macOS Keychain data, browser profile/Local State files from Chrome, Brave and Opera, and targets numerous cryptocurrency wallet browser extensions, exfiltrating the data to a hardcoded C2 at 95.164.17.24:1224.

Beyond credential and wallet theft, the malware fetches additional Python-based payloads from the same C2 via endpoints (/uploads, /pdown, /client/99) matching those Unit42 previously tied to BeaverTail's JavaScript variant. One retrieved payload is a cross-platform Python downloader/executor, and another matches InvisibleFerret, a fully-featured cross-platform backdoor also attributed to the same DPRK operation. The C2 server has been previously flagged as North Korean infrastructure.

The campaign relies on social engineering — luring victims, likely job seekers or those solicited for fake hiring/interview meetings, into running the malicious "MiroTalk" app — rather than any novel exploit. Objective-See notes its free tools BlockBlock (Notarization Mode) and LuLu can respectively block execution of the unnotarized binary and alert on its outbound C2 connection, providing detection even without prior signature knowledge.

Mentioned in this report

Threat actors North Korea-nexus activity (unattributed)

Malware BeaverTailInvisibleFerret

Campaigns Contagious Interview

Detection guidance

Unsigned Mach-O Application Accessing macOS Keychain

ATT&CK T1555 · status experimental · needs macos process_creation logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general.

Detects unsigned or ad-hoc signed Mach-O binaries spawning security_agent or accessing Keychain databases—typical credential theft on macOS. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Unsigned Mach-O Application Accessing macOS Keychain
description: Detects unsigned or ad-hoc signed executables (common in malware distribution
  via DMG) spawning security_agent process or directly accessing Keychain credential
  stores. This matches the BeaverTail macOS variant harvesting login credentials.
tags:
- attack.credential-access
- attack.t1555
logsource:
  category: process_creation
  product: macos
detection:
  selection_keychain_access:
    Image|endswith:
    - /security_agent
    ParentImage|contains:
    - /Volumes/
    CommandLine|contains: Keychain
  selection_unsigned_binary:
    ParentImage|endswith:
    - .app/Contents/MacOS
    Image|endswith:
    - /security_agent
  filter_system:
    ParentImage|contains:
    - /System/Library/
    - /usr/libexec/
  condition: (selection_keychain_access or selection_unsigned_binary) and not filter_system
falsepositives:
- Legitimate third-party password managers accessing Keychain during sync
- System UI processes requesting Keychain authorization prompts
level: high
id: a887b05c-d64e-5cad-9a91-5029d2611be0
status: experimental
author: Vorant

1 more detection for this report is in the app — an indicator rule with Sigma, Splunk SPL, Elastic, Microsoft Defender XDR KQL, and YARA. Free account, no card.

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://objective-see.org/blog/blog_0x7A.html

Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the actors, malware, and campaigns it names. The paid plans add the security research and news reporting the free tier leaves out.

It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.

Create a free account What it costs