Firefox 0-day drops NetWire RAT on crypto exec
A patched Firefox zero-day (CVE-2019-11707) was used in a spearphishing attack to silently install a new OSX.NetWire.A variant on a cryptocurrency exchange employee's Mac.
A user affiliated with a cryptocurrency exchange was targeted with a spearphishing email impersonating an 'Adams Prize' award coordinator, containing a link that exploited an unpatched Firefox vulnerability (now fixed as CVE-2019-11707) to drop persistent macOS malware without any user interaction. Because the exploit delivered the payload directly rather than via a user download, the malicious app never received a quarantine attribute, allowing it to bypass both Gatekeeper and, initially, XProtect scanning logic despite Apple having a matching YARA signature since 2016.
Analysis of the dropped binary (masquerading as Finder.app) showed it shares significant code overlap with a 2012-era OSX.Netwire/Wirenet password-stealing trojan, suggesting a shared author or toolkit lineage, though the 2019 sample's full capabilities differ and were reserved for a follow-up analysis. The malware achieves redundant persistence by installing itself both as a LaunchAgent (RunAtLoad, KeepAlive) and as a macOS Login Item via LSSharedFileListInsertItemURL, ensuring re-execution at every login even at the cost of stealth, since Login Items are visible in system UI.
At time of analysis the sample was detected by only one VirusTotal AV engine (Tencent) despite matching Apple's existing XProtect NetwireA signature from 2016 — a signature that only triggers on quarantined files, again explaining the initial bypass. The exploit landing page was already taken down by the time of investigation, limiting further exploit-chain analysis, but the case illustrates a targeted 0day attack chain against individuals connected to cryptocurrency exchanges.
Mentioned in this report
Detection guidance
Suspicious Application Installing Login Items via LSSharedFileList
Detects processes writing to LSSharedFileList plist to register persistent login items — typical RAT/trojan persistence on macOS. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Application Installing Login Items via LSSharedFileList
description: Detects processes modifying LSSharedFileList property list files to register
Login Items for persistence. This behaviour is characteristic of macOS trojans and
RATs establishing redundant boot-time execution without requiring LaunchAgent plists.
tags:
- attack.persistence
- attack.t1547.015
logsource:
category: file_event
product: macos
detection:
selection:
TargetFilename|contains:
- Library/Application Support/com.apple.sharedfilelist/com.apple.LSSharedFileList.ApplicationRecentDocuments.sfl
- Library/Application Support/com.apple.sharedfilelist/com.apple.LSSharedFileList.LoginItems.sfl
EventType: Modified
filter_system_processes:
Image|startswith:
- /usr/libexec/
- /System/Library/
- /Applications/System Preferences.app
- /System/Applications/System Settings.app
condition: selection and not filter_system_processes
falsepositives:
- Legitimate applications adding themselves to Login Items via system settings
- User manual addition of apps to Login Items via System Preferences UI
level: high
id: cc8d325b-596e-5d61-88b6-053f8f9c3ed3
status: experimental
author: Vorant
1 more detection artefacts for this report (IOC-atomic rules, Splunk/KQL/Elastic conversions, YARA, Suricata) are available to subscribers.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://objective-see.org/blog/blog_0x43.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free