Keypoints
- Threat delivered via repackaged cracked macOS PKG images containing an “Activator” app that prompts for admin credentials.
- Activator copies an embedded Python installer to /tmp and executes a bundled Mach-O “tool” with elevated privileges using AuthorizationExecuteWithPrivileges.
- “tool” patches the target app by removing a specific 16-byte prefix, then fetches an AES-CBC encrypted Python script from DNS TXT records assembled from fragments hosted under imohub[.]net.
- Downloaded scripts are written to /var/root/Library/Caches/.py and persistence is achieved by creating /Library/LaunchAgents/launched..plist entries; one script repeatedly kills NotificationCenter to suppress alerts.
- Backdoor stage executes Base64-encoded Python commands from the C2, gathers system metadata (OS, users, apps, CPU, external IP) and can run arbitrary commands with elevated rights.
- Attackers host infected wallet binaries on apple-analyser[.]com and replace Exodus and Bitcoin-Qt with tampered versions; Exodus’s wallet/index.js exfiltrates seed phrases to 22.imohub.workers.dev.
- C2 infrastructure and payloads rotated frequently (IP/domains changed every ~10–20 minutes) and multiple script versions/hashes were observed during analysis.
MITRE Techniques
- [T1204.002] User Execution: Malicious File – The attack relies on user copying the cracked app and launching Activator to start the chain (‘The instruction tells the user to copy the app to /Applications/ and then launch Activator.’)
- [T1548] Abuse Elevation Control Mechanism – Activator used AuthorizationExecuteWithPrivileges to obtain admin privileges and prompt for the admin password (‘Activator employed the now-obsolete AuthorizationExecuteWithPrivileges function, which brought up the window with the admin password prompt.’)
- [T1059.006] Command and Scripting Interpreter: Python – Core payloads and backdoor logic are implemented as Python scripts executed by the installed Python runtime (‘The decrypted message contained the following Python script.’ and ‘the main function of the script was to execute arbitrary commands it received from the server.’)
- [T1071.004] Application Layer Protocol: DNS – C2 retrieval used DNS TXT queries to assemble Base64 ciphertext fragments for the payload (‘the sample made a request to a DNS server as an attempt to get a TXT record for the domain.’)
- [T1105] Ingress Tool Transfer – The campaign downloads additional payloads (infected wallet binaries and Electron framework) from attacker-controlled hosts (‘the server also stored a clean version of the Electron framework … and Exodus.scpt’ and ‘tried to download and execute the following script.’)
- [T1547.001] Boot or Logon Autostart Execution: Launch Agent – Persistence created via LaunchAgents in /Library/LaunchAgents to autostart malicious scripts (‘Writing to /Library/LaunchAgents/launched..plist two agents that autostart the scripts on reboot.’)
- [T1041] Exfiltration Over C2 Channel – Wallet seed phrases and wallet metadata are sent to attacker channels/C2 (e.g., 22.imohub.workers.dev) (‘the malicious actors had added … a call to a function that simply sent an entered seed phrase to the C2 through the channel.’)
- [T1036] Masquerading – Repackaging legitimate cracked apps into PKG installers to trick users into running the Activator and installing the malicious chain (‘The malicious actors repackaged pre-cracked applications as PKG files …’)
Indicators of Compromise
- [Domain] C2 and payload hosts – imohub[.]net, apple-analyser[.]com (used to host payloads and infected wallets)
- [Domain] Additional C2/channel endpoints – 22.imohub[.]workers[.]dev, apple-health[.]org (used for payload polling and command delivery)
- [File name] Installer and binaries – Activator.app, tool (Mach-O), GUI (main executable) — used in initial stage and privilege elevation
- [File path] Persistence and staging – /var/root/Library/Caches/<uuid>.py (staged downloader/backdoor), /Library/LaunchAgents/launched.<uuid>.plist (autostart agents)
- [Application] Targeted wallet apps – Exodus.app (main/index.js, wallet/index.js modified), Bitcoin-Qt (trojanized Mach-O) — replaced with infected versions that steal seeds/passwords
- [Script hashes] Observed payload hashes – 18c564a5cc4b7414df8345a8bdce7418, f4282d7e32c7e8ab4e075c572ac43803, and 1 more hash (versions of the third-stage script observed during analysis)
Cracked macOS installers in this campaign present a staged technical procedure: the delivered DMG/PKG contains an Activator app and the target application; when the user follows the provided instructions and runs Activator, the app copies an embedded Python installer to /tmp and executes a bundled Mach-O “tool” with elevated privileges by calling AuthorizationExecuteWithPrivileges. The “tool” checks for an existing Python 3 install (installing the bundled version if absent), patches the supplied application by removing a 16-byte prefix to enable the cracked app, then reaches out to C2 infrastructure by composing a domain from hardcoded words plus a random subdomain and requesting DNS TXT records to retrieve Base64-encoded AES-CBC ciphertext fragments that are reassembled and decrypted into a Python payload.
After decryption, the tool enforces one-run semantics via an environment variable-stored script hash, writes a persistent downloader/backdoor to /var/root/Library/Caches/<uuid>.py, and creates /Library/LaunchAgents/launched.<uuid>.plist entries to relaunch the scripts on reboot. The staged Python payload polls hosts like apple-health[.]org every 30 seconds for updates, can execute Base64-encoded Python commands supplied by the operator, harvests system metadata (OS version, /Users listing, installed apps, CPU type, external IP), and was observed to have rapidly rotating embedded C2 metadata (GUID, IP/domain) updated every ~10–20 minutes.
Separately, the campaign replaces legitimate wallet applications by downloading infected Electron-based bundles and modified application files from apple-analyser[.]com: Exodus was modified by injecting malicious code into main/index.js and wallet/index.js to capture and send seed phrases to a channel that forwarded data to 22.imohub[.]workers[.]dev, while Bitcoin-Qt was trojanized to capture wallet passwords, names, and balances. Even without active remote commands, these wallet implants enable immediate credential and seed exfiltration. Read more: https://securelist.com/new-macos-backdoor-crypto-stealer/111778/