macOS malware in 2018 exposed RAT and supply chain risks

At a glance

What this is: This is SentinelOne’s review of macOS malware in 2018, showing that RATs, trojanised apps, cryptojacking and phishing all converged on trusted delivery paths and user trust rather than pure exploit chains.

Why it matters: It matters because identity and access assumptions inside endpoint and application trust models can be undermined by signed apps, phishing, and user-approved execution, which affects both human and machine control boundaries.

Context

macOS malware in this article is not presented as a single exploit problem. The deeper issue is trust: attackers repeatedly used signed installers, fake utilities, email lures and app-store distribution to get code executed in ways that bypassed built-in protections or user expectations.

For IAM, PAM and NHI teams, the relevant lesson is that access controls do not end at authentication. When trusted software paths, user consent and privileged execution are combined, the boundary between endpoint compromise and identity misuse becomes much thinner than many programmes assume.

Key questions

Q: What fails first when a signed macOS app turns out to be malicious?

A: The first failure is trust in the distribution path, not necessarily code execution control. If a signed app or updater is allowed to run because it looks legitimate, the control gap is that provenance has been treated as proof of safety. Practitioners should verify behaviour, not only signature status, before they allow software into managed macOS environments.

Q: Why do macOS RATs and trojans increase privilege and lateral access risk?

A: They turn an endpoint infection into a reusable access path. LaunchAgents, reverse shells and privileged utilities can preserve execution after the initial lure and create new opportunities to collect data, impersonate trusted activity or move into adjacent systems. Once malware can act like a resident user process, the access problem becomes broader than malware removal alone.

Q: How do security teams detect persistence on macOS endpoints?

A: Focus on new LaunchAgents, unexpected binaries in Application Support, and processes that reappear after termination. Correlate those events with installer execution and network traffic to known mining or callback infrastructure. Effective detection depends on linking endpoint state, process behaviour, and install history rather than looking at any one signal in isolation.

Q: What should organisations do when trusted channels are used to deliver macOS malware?

A: Treat the channel as compromised for governance purposes and raise controls around install approval, download handling and privilege elevation. When attackers can use app stores, signed packages or user trust to reach execution, the control response has to shift from simple malware blocking to stronger provenance checks and tighter runtime monitoring.

Technical breakdown

Why RATs and backdoors worked well on macOS in 2018

Remote access trojans depend on persistence, command execution and covert data collection once code is running on the host. In the examples here, variants such as Empyre-backed malware, CrossRAT and WindTape used LaunchAgents, LoginItems, downloaded payloads, screenshots and reverse shells to keep a foothold and exfiltrate useful information. macOS protections were not the only issue. The attacker’s real advantage came from disguising execution as an updater, a document utility or a legitimate app workflow, which reduced suspicion at the point of installation.

Practical implication: Treat launch-on-login and updater behaviour as high-signal indicators for endpoint and identity review.

How supply chain trust and signed apps changed the risk picture

A signed application can still be malicious if the trust boundary is the signature rather than the software’s behaviour. AppleJeus is the clearest example in this article: the malicious application had a valid developer signature and therefore bypassed built-in security technologies, even though it delivered a downloader, LaunchDaemon and payload. The same trust problem appears in the App Store examples, where approved apps exfiltrated personal data. This is not just application security. It is a governance failure in software trust, distribution and review.

Practical implication: Validate software provenance and runtime behaviour, not just signing status, before permitting execution in managed environments.

Why cryptojacking and phishing targeted user trust rather than exploit chains

Cryptojacking and wallet theft in this article succeeded by manipulating user intent. Fake cracking tools, crypto utilities and phishing emails promised a benefit the victim wanted, then installed reverse shells, spyware or miners after the user cooperated. That shifts the attack surface from vulnerability exploitation to social engineering and consent abuse. On macOS, that matters because the operating system’s trust cues, application permissions and user prompts can all be used to make malicious code appear routine. The attack is successful when the user becomes the control bypass.

Practical implication: Pair endpoint controls with user-awareness controls for download, consent and privilege escalation decisions.

Threat narrative

Attacker objective: The objective was to gain persistent macOS access for surveillance, cryptomining, and theft of personal or cryptocurrency-related data.

1. Entry often began with trojanised apps, malicious updaters, phishing emails or trusted download paths that caused the victim to execute attacker-controlled code.
2. Credential or session abuse followed through reverse shells, LaunchAgents, LoginItems, and payloads that could capture screenshots, steal data or persist on the host.
3. The final impact was surveillance, cryptomining, credential theft or exfiltration of wallet and personal data, often while the malware remained hidden behind apparently legitimate software.

Breaches seen in the wild

• Shai Hulud npm malware campaign: Shai Hulud campaign: npm malware exposed secrets on GitHub.
• CircleCI breach 2023: Malware stole a CircleCI engineer's SSO session; attackers exfiltrated customers' CI/CD secrets and keys, forcing a platform-wide rotation.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Platform trust was the real attack surface in 2018 macOS malware. The article shows that signed software, trusted apps, user-approved utilities and expected installer workflows were all turned into delivery mechanisms. That means the weak point was not only exploitation. It was the assumption that trusted distribution paths are inherently safe. Practitioners should treat trust boundaries as security controls that need continuous verification.

macOS malware in this period blurred endpoint security and identity governance. When attackers use LaunchAgents, LoginItems, reverse shells or privileged utilities, they are not just infecting a device. They are creating a new runtime identity with access pathways that were never intended for the malware. That is why endpoint compromise increasingly becomes a privilege and access problem, not only a malware problem. Practitioners should align endpoint telemetry with access governance.

Supply chain confidence without behaviour validation creates governance debt. AppleJeus, App Store abuse and trojanised utilities show that signature checks and store controls can be necessary but insufficient if runtime behaviour is not inspected. The named concept here is trusted distribution blind spot: a gap where software is allowed in because of where it came from, not because of what it does. Practitioners should close that blind spot with stronger provenance and execution controls.

Cryptocurrency-targeted malware exposed a convergence between fraud, endpoint abuse and identity misuse. The campaign mix in this article includes wallet theft, cryptomining and phishing, all of which depend on convincing a user or system to trust the wrong thing. That convergence matters because identity teams cannot assume the problem is isolated to endpoints. When a user or administrator is manipulated into installing malicious code, the resulting access path becomes part of the identity risk model. Practitioners should treat user trust as a governable security dependency.

macOS in 2018 showed that mature-looking platforms still fail when execution policy is too permissive. The repeated use of adware installers, fake utilities and approved app channels suggests that default trust can outpace defensive scrutiny. In framework terms, the risk spans application trust, endpoint execution control and privileged activity monitoring. Practitioners should harden the approval path before attackers turn convenience into persistence.

What this signals

Trusted distribution blind spot: macOS malware in 2018 showed that signature checks, app-store approval and familiar updater paths are not enough if execution behaviour is not separately governed. Practitioners should assume that any trust mechanism can be repurposed as a delivery path and design controls that verify what software does after launch.

The access lesson is broader than Apple-specific malware. When a trojan uses LaunchAgents, reverse shells or elevated utilities, it creates a runtime identity that can outlive the original lure. That is why endpoint monitoring and access governance need to be coordinated, not treated as separate domains.

For practitioners

• Harden application provenance checks Require validation of software origin, signing context and expected runtime behaviour before allowing installation or execution in managed macOS estates.
• Monitor LaunchAgents and LoginItems Alert on new persistence entries, especially those created by utilities, updaters or archive-based installers that should not establish background execution.
• Restrict privilege escalation paths Review which user actions can elevate permissions on macOS and remove unnecessary admin rights from employees who do not need them.
• Detect reverse-shell and screenshot behaviour Instrument endpoint telemetry for repeated screenshot capture, outbound command channels and short-interval beaconing that match RAT-style activity.
• Separate cryptocurrency workflows from general user endpoints Use stricter controls for staff who handle wallets, exchanges or mining tools so a single phishing or trojanised app cannot reach higher-value assets.

Key takeaways

• The main lesson from this macOS malware year is that trusted software paths can be more dangerous than obvious exploits when attackers can hide behind normal execution cues.
• The article shows repeated use of RATs, trojans, cryptomining and phishing to reach persistence, data theft and wallet access without relying on a single exploit family.
• Practitioners should tighten provenance validation, persistence monitoring and privilege control together, because the attack surface spans both endpoint behaviour and trust decisions.

Key terms

• Remote Access Trojan: A remote access trojan is malware that gives an attacker interactive control over a compromised system after execution. It usually combines a loader, persistence and a command channel so the attacker can issue instructions, exfiltrate data or deploy additional payloads without repeatedly exploiting the target.
• LaunchAgent: A LaunchAgent is a macOS persistence mechanism that starts user-level processes automatically. Attackers abuse it to relaunch malware after reboot or login, which makes a one-time infection survive long enough to steal data, fetch later stages, or maintain command access.
• Trojanized Application: A trojanized application is a legitimate-looking app that has been altered to carry malicious code. Users believe they are installing a normal tool, but the bundled payload can execute backdoors, steal data, or establish persistence immediately after launch.
• Trusted-delivery blind spot: A trusted-delivery blind spot is the gap that appears when defenders assume a platform-native mail route is safe because it comes from trusted infrastructure. In practice, attackers can use that same route to deliver malicious content, so the trust decision and the inspection decision must be separated.

Deepen your knowledge

NHI Mgmt Group’s NHI Foundation Level course covers NHI governance, workload identity, secrets management and human identity controls. It is the industry's only accredited NHI security programme for practitioners who need to govern access across modern identity estates.