Objective-See recaps 2018 Mac malware crop

2 August 2026 routine threat technology

Objective-See's annual roundup details a year of new macOS malware including DNS-hijacking, cryptominers, RATs, and adware droppers.

This Objective-See blog post is an annual retrospective cataloguing the new macOS malware families that emerged throughout 2018, describing each specimen's infection vector, persistence mechanism, and capabilities. The families covered range from commodity threats like cryptominers (CreativeUpdate, PPMiner) and adware droppers (Shlayer) to more capable backdoors and RATs (CrossRAT, ColdRoot, Dummy, Calisto) and a DNS-hijacking trojan (MaMi) that installs a rogue root certificate to enable man-in-the-middle traffic interception.

Most infections relied on social engineering — malicious popups, trojanized downloads from compromised or lookalike sites (MacUpdate.com, fake cdn-mozilla.net), BitTorrent-delivered fake Flash updates, and direct victim self-infection via crypto-community Discord/Slack impersonation. Persistence across nearly all samples was achieved through standard macOS LaunchDaemon/LaunchAgent plists set to RunAtLoad, a technique Objective-See's BlockBlock tool is shown detecting repeatedly. CrossRAT stands out as part of a broader cyber-espionage campaign (Dark Caracal) attributed by EFF/Lookout research, while the remaining families are largely opportunistic commodity malware focused on cryptomining, adware monetization, or general backdoor access.

Overall severity is low: this is a historical/informational compilation of already-disclosed 2018 malware rather than a report of new or ongoing active exploitation. No CVEs are involved, and most described threats are low-sophistication, opportunistic tools relying on user interaction rather than technical exploitation.

Mentioned in this report

Threat actors Dark Caracal

Malware ColdrootCrossRATOSX.CalistoOSX.CreativeUpdateOSX.DummyOSX.MaMiOSX.PPMinerOSX/ShlayerXMRIG

Detection guidance

Suspicious System Process Modification via Launchctl

ATT&CK T1543.004

Detects launchctl commands loading or enabling user-writable plist files - used for Launch Daemon persistence by macOS malware. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious System Process Modification via Launchctl
description: Detects launchctl load or enable commands targeting plist files in user-writable
  directories (Library/LaunchAgents, Library/LaunchDaemons) - technique used by macOS
  malware to achieve Launch Daemon persistence.
tags:
- attack.persistence
- attack.t1543.004
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    Image|endswith: /launchctl
    CommandLine|contains:
    - load
    - enable
  selection_path:
    CommandLine|contains:
    - /Library/LaunchAgents/
    - /Library/LaunchDaemons/
  filter_system:
    CommandLine|contains:
    - /System/Library/LaunchDaemons/
    - /System/Library/LaunchAgents/
  condition: selection and selection_path and not filter_system
falsepositives:
- Legitimate macOS software installation scripts using launchctl to load services
- System administration and configuration management tools
level: medium
id: c7d3113c-5ed2-5d54-a054-420326b8e209
status: experimental
author: Vorant

Shell Command Execution via Malicious Download and Pipe Chain

ATT&CK T1059.004

Detects shell invocation chains combining curl/wget download with pipe to bash/sh - typical infection pattern for macOS malware delivered via compromised sites and drive-by downloads. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Shell Command Execution via Malicious Download and Pipe Chain
description: Detects curl or wget piped directly to bash or sh - common infection
  vector for macOS malware delivered via compromised websites, fake updates, and drive-by
  downloads. Observed across CreativeUpdate, PPMiner, Shlayer, and other 2018 families.
tags:
- attack.execution
- attack.t1059.004
- attack.t1204.002
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    CommandLine|contains:
    - '| bash'
    - '| sh'
    - '| /bin/bash'
    - '| /bin/sh'
  filter_legitimate:
    CommandLine|contains:
    - apt-get
    - homebrew
    - github.com
    - apple.com
  condition: selection and not filter_legitimate
falsepositives:
- Legitimate shell scripts installing software from trusted package repositories
- Automated system configuration tools using curl to fetch remote scripts
level: high
id: 2d97ecfd-3b2c-5229-a03d-00677bafa682
status: experimental
author: Vorant

1 more detection artefacts for this report (IOC-atomic rules, Splunk/KQL/Elastic conversions, YARA, Suricata) are available to subscribers.

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://objective-see.org/blog/blog_0x3C.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free