3CX supply chain attack — ElectroRAT, iWebUpdate +30
Objective-See blog archive detailing macOS security research from 2017-2026, covering malware analysis, vulnerability disclosures, and defensive tooling development.
This article is a chronological archive of Objective-See's security research blog spanning nearly a decade of macOS threat intelligence and vulnerability research. The entries cover a wide range of topics including newly discovered macOS malware families (stealers, ransomware, adware, RATs, cryptocurrency miners), analysis of APT campaigns targeting macOS users, and disclosure of zero-day vulnerabilities in macOS itself.
Recent entries from 2025-2026 focus on emerging threats like ClickFix social-engineering attacks, macOS stealer malware, and Apple's incremental security improvements including TCC event integration into Endpoint Security and anti-paste protections. Historical entries document significant campaigns including DPRK-attributed operations (Lazarus Group's BeaverTail, SpectralBlur, AppleJeus), supply-chain compromises (3CX/SmoothOperator), and cross-platform threats (CrossRAT, SysJoker). Multiple entries detail local privilege escalation and sandbox escape vulnerabilities discovered by the author and guest researchers, several of which remained unpatched for extended periods.
The blog also provides annual retrospectives on Mac malware trends, defensive research on building security tools using Apple's Endpoint Security framework, and reverse-engineering deep-dives into macOS internals. The content serves both as threat intelligence for defenders and as a historical record of the macOS threat landscape's evolution from commodity adware to sophisticated nation-state tooling.
Mentioned in this report
Detection guidance
Suspicious LaunchAgent/LaunchDaemon Plist Created by Non-Standard Process
Detects creation of a persistence plist in LaunchAgents/LaunchDaemons directories by a process other than typical installers, consistent with macOS malware establishing persistence (as seen in 3CX/SmoothOperator and related macOS implants). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious LaunchAgent/LaunchDaemon Plist Creation
logsource:
category: file_event
product: macos
detection:
selection:
TargetFilename|contains:
- /Library/LaunchAgents/
- /Library/LaunchDaemons/
TargetFilename|endswith: .plist
filter_legit:
Image|startswith:
- /usr/sbin/installer
- /System/Library/
- /usr/libexec/
condition: selection and not filter_legit
falsepositives:
- Legitimate software installers or system updates writing new LaunchAgent/LaunchDaemon
plists
- MDM-managed software deployment creating persistence plists
level: medium
tags:
- attack.t1543.001
- attack.t1547.011
- attack.persistence
id: 56ce71be-6d80-5d3b-987b-200b052d497d
status: experimental
author: Vorant
Gatekeeper Quarantine Attribute Removal via xattr
Detects use of the xattr command to strip the com.apple.quarantine extended attribute from a downloaded file, a common Gatekeeper bypass technique used by macOS malware droppers before execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Quarantine Attribute Removal via xattr Command
logsource:
category: process_creation
product: macos
detection:
selection:
Image|endswith: /xattr
CommandLine|contains:
- -d com.apple.quarantine
- -c
- com.apple.quarantine
condition: selection
falsepositives:
- Developers manually clearing quarantine flags on self-built or trusted downloaded
applications
- Sysadmin scripts that bulk-clear quarantine attributes after internal software vetting
level: high
tags:
- attack.t1553.001
- attack.defense-evasion
id: 20d734e6-7b6c-56af-a73a-67aa25a46258
status: experimental
author: Vorant
Keychain Credential Dumping via security Command
Detects invocation of the macOS security command-line utility with flags to dump or export keychain items, a technique used by macOS stealers and RATs to harvest stored credentials and cookies. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Keychain Dump via security Command Line Utility
logsource:
category: process_creation
product: macos
detection:
selection:
Image|endswith: /security
CommandLine|contains:
- dump-keychain
- find-generic-password
- find-internet-password
- export
filter_legit:
ParentImage|endswith:
- /Xcode
- /xcodebuild
condition: selection and not filter_legit
falsepositives:
- Developer tooling or CI pipelines querying the keychain for signing credentials
- IT automation scripts retrieving stored service account passwords
level: high
tags:
- attack.t1555.001
- attack.t1539
- attack.credential-access
id: af090e02-b909-5c13-bf5c-2c78cd8e9fdb
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://objective-see.org/blog.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free