OSX/MaMi DNS hijacker targets macOS

PublishedThe source gives no date · added 2 August 2026 Vorant ratingroutine threat

Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

A new macOS malware dubbed OSX/MaMi hijacks DNS settings and installs a rogue root certificate to enable man-in-the-middle attacks.

Sourceobjective-see.org — open the original

What to check

Applies to: Whether this concerns you is not assessed; the names the report mentions are listed below.
Date: The source gives no publication date; the date shown is the day Vorant added the brief.

Objective-See researcher Patrick Wardle analyzed a newly discovered macOS malware sample, named OSX/MaMi after an internal class name (SBMaMiSettings), after it was flagged on a MalwareBytes forum post. The unsigned Mach-O binary, hosted at regardens.info and undetected by all 59 VirusTotal engines at time of analysis, hijacks a victim's DNS servers (setting them to 82.163.143.135 and 82.163.142.137) and installs a malicious root CA certificate (CN=cloudguard.me) into the System keychain, enabling potential traffic interception and man-in-the-middle attacks. The malware also contains capabilities for taking screenshots, simulating mouse clicks, running AppleScript, downloading/uploading files, and executing arbitrary commands, though the researcher did not observe these being triggered during his limited analysis session.

The malware's configuration data revealed C2 reporting domains (honouncil.info, gorensin.info, squartera.info) used for activity/time reporting via HTTP, along with hardcoded placeholder domains. The researcher noted strong overlaps — identical DNS hijack IP ranges and the same malicious certificate — with a 2015 Windows malware called DNSUnlocker, suggesting OSX/MaMi may be a macOS port of that older Windows DNS hijacker with added platform-specific functionality. Infection vector remains unknown at time of writing, though phishing, fake security alerts, or social engineering are suspected.

Remediation guidance includes checking DNS settings via networksetup or System Preferences, inspecting the System keychain for the cloudguard.me certificate, and removing both if found; a full OS reinstall is recommended for thoroughness given the malware's capability to potentially deploy further payloads. No AV detection existed at publication time, and the author notes a forthcoming open-source firewall tool (LuLu) intended to detect the malware's network traffic.

Mentioned in this report

Malware DNSUnlockerOSX.MaMi

Detection guidance

Unsigned Mach-O Binary Execution with Screen Capture and AppleScript Capabilities

ATT&CK T1059.002 · status experimental · needs macos process_creation logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general.

Detects execution of unsigned Mach-O binaries performing screen capture or AppleScript execution, consistent with OSX/MaMi malware behavior. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Unsigned Mach-O Binary Execution with Screen Capture and AppleScript Capabilities
description: Detects execution of unsigned binaries that spawn screen capture utilities
  or invoke AppleScript interpreters, indicative of OSX/MaMi's remote control and
  reconnaissance capabilities.
tags:
- attack.t1059.002
- attack.t1113
- attack.execution
logsource:
  category: process_creation
  product: macos
detection:
  selection_screencapture:
    ParentImage|endswith:
    - /screencapture
    CommandLine|contains:
    - -x
    - -S
  selection_osascript:
    Image|endswith: /osascript
    ParentImage|endswith|all:
    - /private/tmp
    - /Users/*/Library/Caches
    - /Users/*/Library/Application Support
  selection_applescript_exec:
    CommandLine|contains: osascript
    ParentImage|startswith:
    - /var/tmp
    - /tmp
  filter_legitimate:
    ParentImage|endswith:
    - /System/Library/CoreServices/Finder.app
    - /System/Library/CoreServices/Automator.app
    - /Applications/Script Editor.app
  condition: (selection_screencapture or selection_osascript or selection_applescript_exec)
    and not filter_legitimate
falsepositives:
- Legitimate automation scripts and user-initiated AppleScript execution
- System screen recording or sharing applications
level: medium
id: 0d863fba-45ea-5ca3-840f-1727d5456ac3
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://objective-see.org/blog/blog_0x26.html

Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the malware it names. The paid plans add the security research and news reporting the free tier leaves out.

It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.

Create a free account What it costs