CrossRAT is a multi-platform surveillance tool that manifests itself on macOS by writing a copy of itself to ~/Library/mediamgrs.jar and installing a user LaunchAgent for persistence. In the same month, the Java-based CrossRAT was uncovered as part of the toolkit of Dark Caracel APT, a group that gathers intelligence for national security purposes and offensive cyber capabilities allegedly on behalf of the Lebanese government. The malware contains logic for downloading and uploading files remotely, recording mouseClicks, taking screenshots and attempting privilege escalation. Mami alters macOS’s ist in order to hijack the victim’s DNS servers. The year began with OSX.MaMi, a suspected macOS variant of an older Windows malware, DNSUnlocker. Cryptojacking remains on the rise, but confined largely to the ever-present macOS adware problem. Cryptocurrencies have also been big in the malware news this year as bad actors have both targeted bitcoin wallets and made use of cryptocurrency utilities to infect unsuspecting users. EvilOSX, EvilEgg and a Java-based RAT also made appearances in the wild. As 2018 starts to wind down, we take a look at how the macOS security situation has unfolded throughout the year.Ģ018 has been very much the year of the RAT for macOS, with Empyre leading the way as the exploitation framework of choice for several malware variants.

Dr cleaner pro mac malware