Objective-See Catalogs 2021's New macOS Malware
Objective-See's annual roundup details seven new 2021 macOS malware families—ElectroRAT, SilverSparrow, XcodeSpy/EggShell, ElectrumStealer, WildPressure, XLoader, and ZuRu—covering RATs, stealers, and backdoors.
Sourceobjective-see.org — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
This is Objective-See's sixth annual comprehensive review of new macOS malware, compiling and re-analyzing specimens first reported by various AV vendors throughout 2021, complete with downloadable samples and technical breakdowns of infection vectors, persistence, and capabilities. Highlights include OSX.ElectroRAT, a Go-based cross-platform RAT distributed via trojanized fake cryptocurrency trading apps that embeds camera-capture, Chrome password-stealing, keylogging, and VNC tools and calls out to pastebin for C2 discovery; OSX.SilverSparrow, a mysterious payload-less M1-native dropper that infected roughly 30,000 Macs via unknown delivery of malicious .pkg installers using the macOS Installer JavaScript API; and OSX.XcodeSpy, which poisons open-source Xcode projects with a hidden build script to drop a custom EggShell backdoor onto developer machines — an early example of a software supply-chain-style attack on macOS.
Other entries include OSX.ElectrumStealer, a backdoored Electrum wallet clone that was inadvertently notarized by Apple and distributed via malvertising/fake update prompts to steal cryptocurrency wallets and passwords; a macOS port of WildPressure, a cross-platform Python backdoor with suspected limited targeting of Middle East oil-and-gas users; XLoader, the macOS-capable evolution of the FormBook stealer sold as MaaS and distributed via phishing (including malicious .jar attachments), which harvests Firefox and Chrome credentials; and OSX.ZuRu, distributed through malicious Baidu sponsored search ads mimicking legitimate app sites (e.g., iTerm), which conducts extensive system reconnaissance/exfiltration before dropping a Cobalt Strike agent.
Collectively the post underscores growing macOS targeting as Apple gains enterprise market share, with infection vectors ranging from trojanized applications and malvertising to subverted developer tooling and MaaS phishing kits. No single campaign is attributed to a named threat actor with confidence; WildPressure is noted as likely targeted at Middle East oil and gas organizations, while the rest largely target general cryptocurrency users, developers, and broad Chinese-language search traffic.
Mentioned in this report
Detection guidance
Suspicious Launch Agent Creation in Library Directories
A behavioural hunt for the technique in general.
Detects creation of .plist files in ~/Library/LaunchAgents or system LaunchDaemons directories — persistence mechanism used by ElectroRAT, SilverSparrow, and other macOS malware. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Launch Agent Creation in Library Directories
description: "Detects .plist file creation in ~/Library/LaunchAgents, ~/Library/LaunchDaemons,\
\ or /Library/LaunchDaemons \u2014 common macOS persistence mechanism. Generalizes\
\ on the directory path and file extension rather than specific plist names or content."
tags:
- attack.persistence
- attack.t1543.001
logsource:
category: file_event
product: macos
detection:
selection:
TargetFilename|contains:
- /Library/LaunchAgents/
- /Library/LaunchDaemons/
- /System/Library/LaunchDaemons/
TargetFilename|endswith: .plist
filter_apple_system:
TargetFilename|contains:
- /System/Library/LaunchDaemons/com.apple
- /System/Library/LaunchAgents/com.apple
filter_legitimate_admin:
Image|contains:
- /usr/libexec/installd
- /System/Library/CoreServices/Installer Progress.app
condition: selection and not filter_apple_system and not filter_legitimate_admin
falsepositives:
- Legitimate software installers or MDM tools registering launch agents
- System updates or OS installation processes
level: high
id: 86b69c72-8635-5db7-8ba1-80d5d57b2590
status: experimental
author: Vorant
3 more detections for this report are in the app — indicator rules, each with Sigma, Splunk SPL, and Elastic, some with Microsoft Defender XDR KQL, YARA, or Suricata as well. Free account, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://objective-see.org/blog/blog_0x6B.html
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs