Malware

CookieMiner

CookieMiner is a macOS-focused information-stealing malware associated with theft of browser-stored data and cryptocurrency-related targeting. It is known for stealing Google Chrome credentials, including saved usernames, passwords, and payment card data, as well as browser cookies from Google Chrome and Apple Safari. By harvesting cookies in addition to credentials, it can facilitate abuse of authenticated web sessions. CookieMiner has also been observed collecting iPhone text messages from local iTunes backup data, indicating broader theft of user information beyond browser artifacts.

The malware includes multiple defense-evasion and anti-analysis behaviors. It checks for the presence of Little Snitch, a macOS network monitoring and firewall product, and terminates execution if it detects that software. It also uses Base64 encoding to obfuscate scripts and performs browser decryption and extraction operations to access protected Chrome data.

For persistence, CookieMiner installs multiple Launch Agents on macOS, including to support continued operation of cryptocurrency-mining components. It has also been observed exfiltrating stolen data over HTTP using command-line upload functionality. Overall, CookieMiner is best characterized as a macOS infostealer with credential theft, cookie theft, persistence, defense evasion, and data exfiltration capabilities, with notable overlap between information theft and cryptocurrency-motivated activity.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

19 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

2 techniques

T1059.004Unix ShellEvidence2

Examples include "CookieMiner has looked for files in the user's home directory with 'wallet' in their name using find .", "Kinsing has used the find command to search for specific files", and "APT41 has executed file /bin/pwd on exploited victims."

T1059.006PythonEvidence1

Persistence

1 technique

T1543.001Launch AgentEvidence2

Bundlore can persist via a LaunchAgent. Calisto adds a .plist file to the /Library/LaunchAgents folder to maintain persistence. CoinTicker creates user launch agents named .espl.plist and com.apple.[random string].plist to establish persistence.

Privilege Escalation

1 technique

T1543.001Launch AgentEvidence2

Stealth

3 techniques

T1027Obfuscated Files or InformationEvidence1

"Action RAT's commands, strings, and domains can be Base64 encoded within the payload." / "ADVSTORESHELL... strings... encrypted with an XOR-based algorithm; some strings are also encrypted with 3DES and reversed." / "APT29 has used encoded PowerShell commands." / "APT41 used VMProtected binaries..."

T1027.010Command ObfuscationEvidence1

T1140Deobfuscate/Decode Files or InformationEvidence7

APT28 macro uses the command certutil -decode to decode contents of a .txt file storing the base64 encoded payload.

Credential Access

3 techniques

T1539Steal Web Session CookieEvidence5

Grandoreiro can steal cookie data and credentials from Google Chrome... Kimsuky has used browser extensions including Google Chrome to steal passwords and cookies from browsers... Inception used a browser plugin to steal passwords and sessions

T1555Credentials from Password StoresEvidence1

Agent Tesla can gather credentials from a number of browsers... APT33 has used a variety of publicly available tools like LaZagne to gather credentials... TrickBot can obtain passwords stored in files from web browsers such as Chrome, Firefox, Internet Explorer, and Microsoft Edge... SELECT action_url, username_value, password_value FROM logins; CryptUnprotectData

T1555.003Credentials from Web BrowsersEvidence8

Agent Tesla can gather credentials from a number of browsers... APT3 has used tools to dump passwords from browsers... APT41 used BrowserGhost, a tool designed to obtain credentials from browsers, to retrieve information from password stores... TrickBot can obtain passwords stored in files from web browsers such as Chrome, Firefox, Internet Explorer, and Microsoft Edge

Discovery

2 techniques

T1083File and Directory DiscoveryEvidence5

The content is a long ATT&CK-style listing of groups and malware that can 'list files and directories,' 'search for files,' 'enumerate drives,' 'gather file metadata,' or 'browse file systems' on compromised hosts.

T1518.001Security Software DiscoveryEvidence3

Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment.

Collection

1 technique

T1005Data from Local SystemEvidence4

Andariel has collected large numbers of files from compromised network systems for later extraction... APT28 has retrieved internal documents from machines inside victim environments... BADNEWS crawls the victim's local drives and collects documents... many listed groups and malware collect files, documents, credentials, payment card data, or other information from compromised hosts.

Command and Control

2 techniques

T1071.001Web ProtocolsEvidence1

CORALDECK has exfiltrated data in HTTP POST headers.

T1105Ingress Tool TransferEvidence2

The content repeatedly describes malware and threat actors that can "download files from C2," "download additional payloads," "upload and download files," "retrieve payloads from the C2 server," and "copy files to remote machines."

Exfiltration

3 techniques

T1048Exfiltration Over Alternative ProtocolEvidence1

Agent Tesla has routines for exfiltration over SMTP, FTP, and HTTP.

T1048.002Exfiltration Over Asymmetric Encrypted Non-C2 ProtocolEvidence1

Rclone can exfiltrate data over FTP or HTTP, including HTTP via WebDAV.

T1048.003Exfiltration Over Unencrypted Non-C2 ProtocolEvidence1

Impact

1 technique

T1496.001Compute HijackingEvidence1

Other

1 technique

T1562.004Disable or Modify System FirewallEvidence1

ACTIVITY FEED

Recent activity

23 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

23 SOURCESView more in app

mitre attack websiteNews

Oct 21, 2021

Data from Local System, Technique T1005 - Enterprise | MITRE ATT&CK®

Stealer malware that retrieves data such as iPhone text messages from backup files.

mitre attack websiteNews

Oct 21, 2021

Credentials from Password Stores: Credentials from Web Browsers, Sub-technique T1555.003 - Enterprise | MITRE ATT&CK®

Credential-stealing malware that targets Chrome-saved usernames, passwords, and credit card data.

mitre attack websiteNews

Oct 21, 2021

Deobfuscate/Decode Files or Information, Technique T1140 - Enterprise | MITRE ATT&CK®

Malware that leverages Chrome decryption and extraction operations.

mitre attack websiteNews

Jan 1, 2021

Deobfuscate/Decode Files or Information, Technique T1140 - Enterprise | MITRE ATT&CK®

Malware that leverages Chrome decryption and extraction operations, likely for credential or cookie theft.

+18 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping19

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

CookieMiner