Objective-See recaps 2019 Mac malware year
Objective-See's annual roundup details 2019 macOS malware including CookieMiner, Lazarus's Yort implant, Siggen backdoor, and BirdMiner cryptominer.
Sourceobjective-see.org — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
- Date
- The source gives no publication date; the date shown is the day Vorant added the brief.
This Objective-See year-in-review consolidates analysis of new macOS malware families observed throughout 2019, providing infection vectors, persistence mechanisms, and capabilities for each. Highlights include OSX.CookieMiner, an evolution of DarthMiner that mines Koto cryptocurrency while stealing Safari/Chrome cookies, saved passwords, credit card data, and iPhone SMS backups to bypass 2FA on cryptocurrency exchange accounts; OSX.Yort, a lightweight Lazarus Group first-stage implant delivered via malicious Office macro documents targeting cryptocurrency professionals, supporting file upload/download and arbitrary command execution over libcurl-based C2; OSX.Siggen, distributed as a trojanized WhatsApp application via a phishing/drive-by site, which persists via launch agent and ultimately deploys a Python-based backdoor leveraging the public Evil.OSX post-exploitation kit; and OSX.BirdMiner (LoudMiner), a Linux cryptominer bundled in nearly 100 pirated VST/audio production applications (e.g., cracked Ableton Live) that runs under QEMU emulation and persists via LaunchDaemons.
Across these samples, common themes emerge: reliance on social engineering (pirated software, fake WhatsApp installer, malicious macro documents) rather than exploited vulnerabilities, use of LaunchAgents/LaunchDaemons for persistence, and a mix of financially motivated cryptomining/credential-theft tooling alongside targeted nation-state espionage activity (Yort/Lazarus). The report serves as a reference archive with downloadable samples and IOCs for defenders and researchers rather than a single incident advisory, and reflects the routine diversity of commodity and targeted Mac threats seen in 2019.
Mentioned in this report
Detection guidance
Launchd Agent or Daemon Creation with Suspicious Plist
A behavioural hunt for the technique in general.
Detection of plist files being written to LaunchAgents or LaunchDaemons directories with executable payloads or suspicious persistence indicators. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Launchd Agent or Daemon Creation with Suspicious Plist
description: Detects creation of plist files in ~/Library/LaunchAgents, /Library/LaunchAgents,
/Library/LaunchDaemons, or /System/Library/LaunchDaemons directories. Malware commonly
uses these for persistence by creating or modifying launch definitions that execute
code at login or system boot. Generalises on the directory path and plist file creation
pattern.
tags:
- attack.persistence
- attack.t1647
logsource:
category: file_event
product: macos
detection:
selection:
TargetFilename|contains:
- /Library/LaunchAgents/
- /Library/LaunchDaemons/
- /System/Library/LaunchDaemons/
TargetFilename|endswith: .plist
filter_apple_system:
TargetFilename|startswith:
- /System/Library/LaunchDaemons/com.apple.
- /System/Library/LaunchAgents/com.apple.
filter_legitimate_apps:
Image|endswith:
- /usr/libexec/installd
- /System/Library/CoreServices/Finder.app/Contents/MacOS/Finder
condition: selection and not filter_apple_system and not filter_legitimate_apps
falsepositives:
- Software installers and package managers (Homebrew, MacPorts) adding legitimate
launch agents
- System updates or official application installers modifying launch definitions
level: high
id: 1c67624c-a2eb-5b3c-ab3b-a574d2416225
status: experimental
author: Vorant
Process Spawning with Suspicious Cryptocurrency or Cookie-related Command Patterns
A behavioural hunt for the technique in general.
Detection of processes executing commands related to cryptocurrency mining, credential harvesting, or browser cookie/password extraction activities. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Process Spawning with Suspicious Cryptocurrency or Cookie-related Command Patterns
description: Detects process execution with command-line arguments or environment
indicators associated with cryptocurrency mining (mining pool URLs, stratum protocols),
credential theft (browser password/cookie extraction utilities), or web session
hijacking. Covers common malware patterns like invocation of curl for C2 communication,
miner processes, or credential dumping utilities.
tags:
- attack.t1496
- attack.credential-access
- attack.t1555.003
logsource:
category: process_creation
product: macos
detection:
selection_mining:
CommandLine|contains:
- stratum+tcp://
- mining.pool
- -c stratum
- --url stratum
selection_credential_theft:
CommandLine|contains:
- Cookies.binarycookies
- Chrome/Default/Cookies
- Login Data
- keychain dump
selection_curl_c2:
Image|endswith: /curl
CommandLine|contains:
- -X POST
- -d
- upload
filter_legitimate_build:
CommandLine|contains:
- brew
- xcode
- CI/CD
condition: (selection_mining or selection_credential_theft or selection_curl_c2)
and not filter_legitimate_build
falsepositives:
- Legitimate cryptocurrency wallet applications or monitoring tools
- Security researchers or penetration testers using credential extraction utilities
in lab environments
level: medium
id: 87aec662-8017-589c-a3d7-0e796699ba6c
status: experimental
author: Vorant
Office Document Launching Shell or Scripting Interpreter
A behavioural hunt for the technique in general.
Microsoft Office applications (Word, Excel, PowerPoint) spawning shell interpreters or scripting engines, typical of malicious macro execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Office Document Launching Shell or Scripting Interpreter
description: Detects Microsoft Office applications spawning bash, sh, python, or osascript
interpreters - classic maldoc/macro execution pattern. Malicious macros often invoke
system shells to download and execute payloads or establish persistence.
tags:
- attack.execution
- attack.t1566.001
- attack.t1204.002
logsource:
category: process_creation
product: macos
detection:
selection:
ParentImage|contains:
- /Microsoft Office/
- /Microsoft Word
- /Microsoft Excel
- /Microsoft PowerPoint
Image|endswith:
- /bin/bash
- /bin/sh
- /usr/bin/python
- /usr/bin/osascript
filter_legitimate:
CommandLine|contains:
- Microsoft
- update
- -psn
condition: selection and not filter_legitimate
falsepositives:
- Office plugins or add-ins that legitimately invoke shell scripts for integration
purposes
- Enterprise deployment scripts using Office applications as a launcher in secure
environments
level: high
id: a184f6d0-8b4a-5ae4-b36f-9d635bceb5bd
status: experimental
author: Vorant
1 more detection for this report is in the app — an indicator rule with Sigma, Splunk SPL, Elastic, Microsoft Defender XDR KQL, and YARA. Free account, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://objective-see.org/blog/blog_0x53.html
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the actors and malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs