Researcher unearths five-year-old macOS backdoor iWebUpdate
Objective-See found an unsigned macOS binary, iWebUpdate, that has quietly persisted since 2018, giving attackers remote download-and-execute capability via a still-live C2.
Sourceobjective-see.org — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
Independent researcher Patrick Wardle discovered a previously undocumented macOS backdoor, dubbed iWebUpdate, while browsing VirusTotal. The unsigned Mach-O binary first appeared in the wild in September 2018 but was still being submitted as recently as February 2023, and VirusTotal telemetry shows at least a dozen infected hosts, none of which were detected by any AV engine on the platform over that five-year span.
Technical analysis showed the malware installs itself to ~/Library/Services/iWebUpdate and persists via a LaunchAgent (~/Library/LaunchAgents/iwebupdate.plist) set to relaunch hourly. On execution it performs system/hardware reconnaissance (OS version, model) using shell commands invoked through popen, then beacons to a hardcoded C2 domain, iwebservicescloud.com, appending the survey data as URL parameters. The C2 can respond with commands to download and execute arbitrary payloads via system(), giving the malware classic first-stage-implant/downloader capabilities. Historical DNS records tie the C2 domain to IP infrastructure previously associated with malicious activity, and the current live C2 was observed resolving to 173.231.184.122.
No attribution, active campaign, or victim sector could be determined from available data — the sample appears to be a low-prevalence but long-lived, undetected backdoor rather than part of a known, actively tracked operation. The author used the discovery to demonstrate detection of the binary's persistence and network activity using Objective-See's free tools (BlockBlock, LuLu, KnockKnock).
Mentioned in this report
Detection guidance
1 detection for this report is in the app — an indicator rule with Sigma, Splunk SPL, Elastic, Microsoft Defender XDR KQL, and YARA. Free account, no card.
Source reporting: https://objective-see.org/blog/blog_0x72.html
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs