Researcher unearths five-year-old macOS backdoor iWebUpdate

Objective-See found an unsigned macOS binary, iWebUpdate, that has quietly persisted since 2018, giving attackers remote download-and-execute capability via a still-live C2.

Independent researcher Patrick Wardle discovered a previously undocumented macOS backdoor, dubbed iWebUpdate, while browsing VirusTotal. The unsigned Mach-O binary first appeared in the wild in September 2018 but was still being submitted as recently as February 2023, and VirusTotal telemetry shows at least a dozen infected hosts, none of which were detected by any AV engine on the platform over that five-year span.

Technical analysis showed the malware installs itself to ~/Library/Services/iWebUpdate and persists via a LaunchAgent (~/Library/LaunchAgents/iwebupdate.plist) set to relaunch hourly. On execution it performs system/hardware reconnaissance (OS version, model) using shell commands invoked through popen, then beacons to a hardcoded C2 domain, iwebservicescloud.com, appending the survey data as URL parameters. The C2 can respond with commands to download and execute arbitrary payloads via system(), giving the malware classic first-stage-implant/downloader capabilities. Historical DNS records tie the C2 domain to IP infrastructure previously associated with malicious activity, and the current live C2 was observed resolving to 173.231.184.122.

No attribution, active campaign, or victim sector could be determined from available data — the sample appears to be a low-prevalence but long-lived, undetected backdoor rather than part of a known, actively tracked operation. The author used the discovery to demonstrate detection of the binary's persistence and network activity using Objective-See's free tools (BlockBlock, LuLu, KnockKnock).

Source reporting: https://objective-see.org/blog/blog_0x72.html