Loading malware…
MacMa, also tracked as OSX.CDDS and sometimes discussed alongside DazzleSpy, is a macOS backdoor associated with cyber-espionage activity targeting macOS users. It has been linked to the China-aligned Daggerfly cluster through reported infrastructure overlap and shared libraries with other bespoke tooling. MacMa has been observed in campaigns aimed at politically sensitive targets, including users visiting pro-democracy websites, and has been delivered using ad hoc Apple Developer code-signing certificates. It is distinct from DazzleSpy at the code level, though the two have been assessed as operationally related in some reporting.
MacMa is a full-featured implant for remote control, surveillance, and data theft on macOS. Reported capabilities include arbitrary command execution, collection of host and user information such as the current username, screen and window capture through Core Graphics APIs, audio recording, local staging of collected files prior to theft, and exfiltration of data over its command-and-control channel. It also supports anti-forensic behavior through creation and modification of file timestamps. Command-and-control communications have used TLS to initialize a custom protocol.
For persistence, MacMa installs a LaunchAgent plist configured to run at load, with some variants restricted to GUI sessions. Reported installations execute with root privileges after login in certain cases. The malware has also been associated with abuse of Apple code-signing to reduce suspicion during delivery. Overall, MacMa is best characterized as a macOS espionage backdoor focused on persistent access, surveillance, host profiling, and exfiltration from targeted systems.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
This led to the in-memory execution of native Mac code, which exploits CVE-2021-30869 to gain root privileges. With this high level of privileges, the malware drops its payload onto the machine. | DazzleSpy, a piece of malware that attacks macOS, was discovered last fall by researchers at ESET... The new malware got a foothold via CVE-2021-1789... exploits CVE-2021-30869 to gain root privileges... That payload is a very full-featured backdoor, providing the attacker the capability to run any arbitrary command on the infected Mac, start a remote screen viewing session, download files from the Mac, steal the keychain, send synthetic mouse clicks, etc.
DazzleSpy, a piece of malware that attacks macOS, was discovered last fall by researchers at ESET... The new malware got a foothold via CVE-2021-1789... exploits CVE-2021-30869 to gain root privileges... That payload is a very full-featured backdoor, providing the attacker the capability to run any arbitrary command on the infected Mac, start a remote screen viewing session, download files from the Mac, steal the keychain, send synthetic mouse clicks, etc. | The new malware got a foothold via CVE-2021-1789, exploited via a JavaScript file named mac.js loaded by the malicious site. This led to the in-memory execution of native Mac code, which exploits CVE-2021-30869 to gain root privileges.
keychain: Dumps the keychain using a CVE-2019-8526 exploit if the macOS version is lower than 10.14.4. The public KeySteal implementation is used.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Google labelled the backdoor “Macma”… Objective-See (under the name “OSX.CDDS”)… we take a deeper dive into macOS.Macma…
Daggerfly is linked to the use and potentially development of MacMa through overlapping command and control infrastructure and shared libraries with other unique tools.
27 distinct techniques documented for this family, organized by ATT&CK tactic.
It infected machines using a combination of two vulnerabilities, one in WebKit (the framework that powers Safari) and one in macOS (a privilege escalation vulnerability). | DazzleSpy, according to the researchers at ESET, was being spread via watering hole attacks via pro-democracy websites in China.
Bundlore can persist via a LaunchAgent. Calisto adds a .plist file to the /Library/LaunchAgents folder to maintain persistence. CoinTicker creates user launch agents named .espl.plist and com.apple.[random string].plist to establish persistence.
The items you’re most likely to see are: /var/root/Library/LaunchAgents/com.apple.softwareupdate.plist ... However, it’s also possible the malware could get dropped into the user folder, in which case you’ll see these paths instead: ~/Library/LaunchAgents/com.apple.softwareupdate.plist
This led to the in-memory execution of native Mac code, which exploits CVE-2021-30869 to gain root privileges.
Bundlore can persist via a LaunchAgent. Calisto adds a .plist file to the /Library/LaunchAgents folder to maintain persistence. CoinTicker creates user launch agents named .espl.plist and com.apple.[random string].plist to establish persistence.
The items you’re most likely to see are: /var/root/Library/LaunchAgents/com.apple.softwareupdate.plist ... However, it’s also possible the malware could get dropped into the user folder, in which case you’ll see these paths instead: ~/Library/LaunchAgents/com.apple.softwareupdate.plist
Green Lambert can create a Launch Agent with the RunAtLoad key-value pair set to true, ensuring the com.apple.GrowlHelper.plist file runs every time a user logs in. Komplex creates a persistent launch agent called ... com.apple.updates.plist. MacMa installs a com.apple.softwareupdate.plist file in the /LaunchAgents folder.
method.MethodClass.clearTrace Uses NSFileManager’s removeItemAtPath to clear various logs
APT28 has performed timestomping on victim files. APT29 has used timestomping to alter the Standard Information timestamps on their web shells to match other files in the same directory. APT32 has used scheduled task raw XML with a backdated timestamp... APT38 has modified data timestamps to mimic files that are in the same folder on a compromised host.
The content repeatedly describes threat actors and malware using valid, stolen, forged, self-signed, or abused code-signing certificates to sign malware and appear legitimate, including examples such as AppleJeus using a valid digital signature from Sectigo, APT41 leveraging code-signing certificates, FIN7 signing Carbanak payloads, and SUNBURST being digitally signed by SolarWinds.
That payload is a very full-featured backdoor, providing the attacker the capability to... send synthetic mouse clicks...
The content repeatedly describes malware and threat actors using commands and APIs such as ipconfig /all, ifconfig, arp -a, route print, nbtstat, netsh, GetAdaptersInfo, and GetIpNetTable to gather IP addresses, MAC addresses, DNS, DHCP, gateways, routing tables, ARP cache, proxy settings, domains, and network adapter/interface details.
The content repeatedly describes malware and threat actors collecting the username, identifying the current user, enumerating logged-on users, or running commands such as whoami, query user, and quser to determine user context on compromised systems.
Tasklist can be used to discover processes running on a system. Numerous malware families and threat groups are described as listing running processes, enumerating PIDs, checking for specific process names, or using APIs such as CreateToolhelp32Snapshot and commands such as tasklist and ps.
The content repeatedly describes malware and threat actors collecting host details such as hostname, OS version, architecture, CPU, memory, BIOS, language, and other machine characteristics; e.g., "Action RAT has the ability to collect the hostname, OS version, and OS architecture of an infected host."
Multiple entries describe enumerating local, logical, or physical drives and disk/volume information, e.g., 'can enumerate local drives,' 'GetLogicalDrives,' 'fsutil fsinfo drives,' 'list drives,' and 'discover logical drive information including the drive type, free space, and volume information.'
That payload is a very full-featured backdoor, providing the attacker the capability to... download files from the Mac...
That payload is a very full-featured backdoor, providing the attacker the capability to... send synthetic mouse clicks...
25 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
44 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
MACMA is a backdoor malware for Apple macOS, distributed via watering hole attacks by Evasive Panda. Details on its specific capabilities are not provided in this content.
A macOS implant referenced as Evasive Panda’s macOS counterpart to MgBot; mentioned in the context of tailoring payload delivery based on OS version.
... MacMa ... (v2.0→v2.1) ...
MacMa (v2.0→v2.1)
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.