Researcher unearths five-year-old macOS backdoor iWebUpdate
Objective-See found an unsigned macOS binary, iWebUpdate, that has quietly persisted since 2018, giving attackers remote download-and-execute capability via a still-live C2.
Independent researcher Patrick Wardle discovered a previously undocumented macOS backdoor, dubbed iWebUpdate, while browsing VirusTotal. The unsigned Mach-O binary first appeared in the wild in September 2018 but was still being submitted as recently as February 2023, and VirusTotal telemetry shows at least a dozen infected hosts, none of which were detected by any AV engine on the platform over that five-year span.
Technical analysis showed the malware installs itself to ~/Library/Services/iWebUpdate and persists via a LaunchAgent (~/Library/LaunchAgents/iwebupdate.plist) set to relaunch hourly. On execution it performs system/hardware reconnaissance (OS version, model) using shell commands invoked through popen, then beacons to a hardcoded C2 domain, iwebservicescloud.com, appending the survey data as URL parameters. The C2 can respond with commands to download and execute arbitrary payloads via system(), giving the malware classic first-stage-implant/downloader capabilities. Historical DNS records tie the C2 domain to IP infrastructure previously associated with malicious activity, and the current live C2 was observed resolving to 173.231.184.122.
No attribution, active campaign, or victim sector could be determined from available data — the sample appears to be a low-prevalence but long-lived, undetected backdoor rather than part of a known, actively tracked operation. The author used the discovery to demonstrate detection of the binary's persistence and network activity using Objective-See's free tools (BlockBlock, LuLu, KnockKnock).
Mentioned in this report
Detection guidance
LaunchAgent Persistence for Hourly Relaunch
Detects creation or modification of LaunchAgent plist files in ~/Library/LaunchAgents/ containing StartInterval for recurring execution - typical macOS backdoor persistence pattern. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: LaunchAgent Persistence for Hourly Relaunch
description: Detects LaunchAgent plist creation/modification in ~/Library/LaunchAgents
with StartInterval key for recurring task execution. Generalises on the LaunchAgent
path and StartInterval pattern used for persistence, not campaign-specific filenames.
tags:
- attack.persistence
- attack.t1547.001
logsource:
category: file_event
product: macos
detection:
selection:
TargetFilename|contains: Library/LaunchAgents
TargetFilename|endswith: .plist
selection_content:
FileContent|contains: StartInterval
condition: selection and selection_content
falsepositives:
- Legitimate software installers creating scheduled LaunchAgent tasks
- System administration tools deploying recurring maintenance tasks
level: medium
id: 348c3e34-0dec-5e55-a3ca-1cb82ee48c4e
status: experimental
author: Vorant
1 more detection artefacts for this report (IOC-atomic rules, Splunk/KQL/Elastic conversions, YARA, Suricata) are available to subscribers.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://objective-see.org/blog/blog_0x72.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free