Objective-See recaps 2019 Mac malware year
Objective-See's annual roundup details 2019 macOS malware including CookieMiner, Lazarus's Yort implant, Siggen backdoor, and BirdMiner cryptominer.
This Objective-See year-in-review consolidates analysis of new macOS malware families observed throughout 2019, providing infection vectors, persistence mechanisms, and capabilities for each. Highlights include OSX.CookieMiner, an evolution of DarthMiner that mines Koto cryptocurrency while stealing Safari/Chrome cookies, saved passwords, credit card data, and iPhone SMS backups to bypass 2FA on cryptocurrency exchange accounts; OSX.Yort, a lightweight Lazarus Group first-stage implant delivered via malicious Office macro documents targeting cryptocurrency professionals, supporting file upload/download and arbitrary command execution over libcurl-based C2; OSX.Siggen, distributed as a trojanized WhatsApp application via a phishing/drive-by site, which persists via launch agent and ultimately deploys a Python-based backdoor leveraging the public Evil.OSX post-exploitation kit; and OSX.BirdMiner (LoudMiner), a Linux cryptominer bundled in nearly 100 pirated VST/audio production applications (e.g., cracked Ableton Live) that runs under QEMU emulation and persists via LaunchDaemons.
Across these samples, common themes emerge: reliance on social engineering (pirated software, fake WhatsApp installer, malicious macro documents) rather than exploited vulnerabilities, use of LaunchAgents/LaunchDaemons for persistence, and a mix of financially motivated cryptomining/credential-theft tooling alongside targeted nation-state espionage activity (Yort/Lazarus). The report serves as a reference archive with downloadable samples and IOCs for defenders and researchers rather than a single incident advisory, and reflects the routine diversity of commodity and targeted Mac threats seen in 2019.
Mentioned in this report
Detection guidance
Launchd Agent or Daemon Creation with Suspicious Plist
Detection of plist files being written to LaunchAgents or LaunchDaemons directories with executable payloads or suspicious persistence indicators. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Launchd Agent or Daemon Creation with Suspicious Plist
description: Detects creation of plist files in ~/Library/LaunchAgents, /Library/LaunchAgents,
/Library/LaunchDaemons, or /System/Library/LaunchDaemons directories. Malware commonly
uses these for persistence by creating or modifying launch definitions that execute
code at login or system boot. Generalises on the directory path and plist file creation
pattern.
tags:
- attack.persistence
- attack.t1547.011
logsource:
category: file_event
product: macos
detection:
selection:
TargetFilename|contains:
- /Library/LaunchAgents/
- /Library/LaunchDaemons/
- /System/Library/LaunchDaemons/
TargetFilename|endswith: .plist
filter_apple_system:
TargetFilename|startswith:
- /System/Library/LaunchDaemons/com.apple.
- /System/Library/LaunchAgents/com.apple.
filter_legitimate_apps:
Image|endswith:
- /usr/libexec/installd
- /System/Library/CoreServices/Finder.app/Contents/MacOS/Finder
condition: selection and not filter_apple_system and not filter_legitimate_apps
falsepositives:
- Software installers and package managers (Homebrew, MacPorts) adding legitimate
launch agents
- System updates or official application installers modifying launch definitions
level: high
id: 1c67624c-a2eb-5b3c-ab3b-a574d2416225
status: experimental
author: Vorant
Process Spawning with Suspicious Cryptocurrency or Cookie-related Command Patterns
Detection of processes executing commands related to cryptocurrency mining, credential harvesting, or browser cookie/password extraction activities. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Process Spawning with Suspicious Cryptocurrency or Cookie-related Command Patterns
description: Detects process execution with command-line arguments or environment
indicators associated with cryptocurrency mining (mining pool URLs, stratum protocols),
credential theft (browser password/cookie extraction utilities), or web session
hijacking. Covers common malware patterns like invocation of curl for C2 communication,
miner processes, or credential dumping utilities.
tags:
- attack.t1496
- attack.credential-access
- attack.t1555.003
logsource:
category: process_creation
product: macos
detection:
selection_mining:
CommandLine|contains:
- stratum+tcp://
- mining.pool
- -c stratum
- --url stratum
selection_credential_theft:
CommandLine|contains:
- Cookies.binarycookies
- Chrome/Default/Cookies
- Login Data
- keychain dump
selection_curl_c2:
Image|endswith: /curl
CommandLine|contains:
- -X POST
- -d
- upload
filter_legitimate_build:
CommandLine|contains:
- brew
- xcode
- CI/CD
condition: (selection_mining or selection_credential_theft or selection_curl_c2)
and not filter_legitimate_build
falsepositives:
- Legitimate cryptocurrency wallet applications or monitoring tools
- Security researchers or penetration testers using credential extraction utilities
in lab environments
level: medium
id: 87aec662-8017-589c-a3d7-0e796699ba6c
status: experimental
author: Vorant
Office Document Launching Shell or Scripting Interpreter
Microsoft Office applications (Word, Excel, PowerPoint) spawning shell interpreters or scripting engines, typical of malicious macro execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Office Document Launching Shell or Scripting Interpreter
description: Detects Microsoft Office applications spawning bash, sh, python, or osascript
interpreters - classic maldoc/macro execution pattern. Malicious macros often invoke
system shells to download and execute payloads or establish persistence.
tags:
- attack.execution
- attack.t1566.001
- attack.t1204.002
logsource:
category: process_creation
product: macos
detection:
selection:
ParentImage|contains:
- /Microsoft Office/
- /Microsoft Word
- /Microsoft Excel
- /Microsoft PowerPoint
Image|endswith:
- /bin/bash
- /bin/sh
- /usr/bin/python
- /usr/bin/osascript
filter_legitimate:
CommandLine|contains:
- Microsoft
- update
- -psn
condition: selection and not filter_legitimate
falsepositives:
- Office plugins or add-ins that legitimately invoke shell scripts for integration
purposes
- Enterprise deployment scripts using Office applications as a launcher in secure
environments
level: high
id: a184f6d0-8b4a-5ae4-b36f-9d635bceb5bd
status: experimental
author: Vorant
1 more detection artefacts for this report (IOC-atomic rules, Splunk/KQL/Elastic conversions, YARA, Suricata) are available to subscribers.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://objective-see.org/blog/blog_0x53.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free