VORANT. Threat Intelligence Sign in Get the full feed

Lazarus macOS malware executes payloads in memory

routine threat financial-services

Lazarus Group's new macOS trojan, distributed via a fake crypto-trading app, downloads and runs payloads entirely from memory without touching disk.

Researchers analyzed a new macOS implant tied to Lazarus Group's ongoing AppleJeus campaign, distributed as a trojanized cryptocurrency trading application (UnionCryptoTrader.dmg) hosted on a purpose-built fake company site, unioncrypto.vip. The unsigned installer package drops a hidden launch daemon and a persistent binary (unioncryptoupdater) into /Library/UnionCrypto, which is executed at every boot to give Lazarus durable access to compromised crypto-exchange-adjacent hosts.

The binary performs basic system fingerprinting (hardware serial number and OS version via IOKit and SystemVersion.plist) and beacons to a C2 endpoint over HTTPS using libcurl. When the server responds with an encrypted payload rather than a placeholder '0', the malware decrypts it and uses NSCreateObjectFileImageFromMemory/NSLinkModule to map and execute the Mach-O payload directly from memory, parsing the LC_MAIN load command to locate and jump to its entry point — avoiding writing the second-stage payload to disk. If in-memory execution fails, the malware falls back to writing the payload to /tmp/updater and executing it via system() before deleting the file.

This in-memory loading technique, while previously discussed in offensive security research and seen in adware like InstallCore, had not previously been observed in public macOS malware, marking a notable evolution in Lazarus's toolset. The malware fits the group's established modus operandi of targeting cryptocurrency exchange employees with trojanized trading software, consistent with the broader AppleJeus operation first documented by Kaspersky. At the time of analysis the C2 server was live but not actively serving a second-stage payload.

Mentioned in this report

Threat actors Lazarus Group
Malware OSX.AppleJeus.Cunioncryptoupdater
Campaigns Operation AppleJeus

Related reporting

Detection guidance

Launch Daemon Creation in Non-Standard Library Path

ATT&CK T1543.004

Unsigned installer or trojanized app dropping launch daemon plist into /Library subdirectory for persistence. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Launch Daemon Creation in Non-Standard Library Path
description: Detects creation of launch daemon plist files in /Library subdirectories
  (excluding standard Apple locations) - typical persistence mechanism for trojanized
  macOS installers. Monitors for .plist files written to /Library/* paths that contain
  daemon configuration.
tags:
- attack.persistence
- attack.t1543.004
logsource:
  category: file_event
  product: macos
detection:
  selection:
    TargetFilename|contains:
    - /Library/LaunchDaemons/
    - /Library/LaunchAgents/
    TargetFilename|endswith: .plist
  filter_apple_official:
    TargetFilename|startswith:
    - /Library/LaunchDaemons/com.apple.
    - /Library/LaunchAgents/com.apple.
  filter_system_updates:
    TargetFilename|contains:
    - softwareupdate
    - mdaemon
  condition: selection and not (filter_apple_official or filter_system_updates)
falsepositives:
- Legitimate third-party software installers creating their own LaunchDaemons
- Enterprise management tools deploying persistent agents
level: medium
id: 092db678-4bbb-5ef5-be54-96a2b76d30fb
status: experimental
author: Vorant

Process Querying System Hardware and OS Information via IOKit

ATT&CK T1082

Unsigned binary reading hardware serial number and OS version for fingerprinting prior to beacon. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Process Querying System Hardware and OS Information via IOKit
description: Detects process accessing IOKit properties and SystemVersion.plist for
  hardware/OS enumeration - typical reconnaissance before C2 communication in trojanized
  macOS apps.
tags:
- attack.discovery
- attack.t1082
logsource:
  category: process_creation
  product: macos
detection:
  selection_iokit:
    CommandLine|contains:
    - IOPlatformSerialNumber
    - IOHardwareModel
    - IOProductName
  selection_sysversion:
    CommandLine|contains: SystemVersion.plist
  selection_defaults_read:
    Image|endswith: /usr/bin/defaults
    CommandLine|contains:
    - IOPlatformSerialNumber
    - IOHardwareModel
  filter_legitimate_admin:
    ParentImage|contains:
    - /Applications/System Preferences.app
    - /System/Applications/System Settings.app
    - mdm
  condition: (selection_iokit or selection_sysversion or selection_defaults_read)
    and not filter_legitimate_admin
falsepositives:
- System profiling tools (Apple Diagnostic Utility, third-party inventory software)
- MDM agents performing legitimate hardware inventory
level: medium
id: ecf020d7-2af3-54f8-81fe-bfce9385c311
status: experimental
author: Vorant

Reflective Mach-O Code Loading via NSCreateObjectFileImageFromMemory

ATT&CK T1620

Binary invoking NSCreateObjectFileImageFromMemory and NSLinkModule to load and execute Mach-O payloads from memory. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Reflective Mach-O Code Loading via NSCreateObjectFileImageFromMemory
description: Detects process using NSCreateObjectFileImageFromMemory/NSLinkModule
  calls to load Mach-O binaries from memory without touching disk - in-memory payload
  execution technique observed in Lazarus macOS implants.
tags:
- attack.defense-evasion
- attack.t1620
logsource:
  category: image_load
  product: macos
detection:
  selection:
    Image|endswith:
    - NSCreateObjectFileImageFromMemory
    - NSLinkModule
    - _dyld_load_image
  filter_xcode_tools:
    ParentImage|contains:
    - /Xcode
    - /Developer/Tools
  filter_standard_loaders:
    ParentImage|contains:
    - /usr/libexec/
    - /System/Library/
  condition: selection and not (filter_xcode_tools or filter_standard_loaders)
falsepositives:
- Legitimate code injection frameworks (JetBrains plugins, game modding engines)
- Development tools performing dynamic code inspection
level: high
id: 1a56b1e5-a2d2-53a2-826b-3af38762c8e0
status: experimental
author: Vorant

1 more detection artefacts for this report (IOC-atomic rules, Splunk/KQL/Elastic conversions, YARA, Suricata) are available to subscribers.

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://objective-see.org/blog/blog_0x51.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free