ATT&CK macOS Malware Software Hub: Detecting Threats to Apple Endpoints in the ATT&CK Catalogue

Mac fleets are often run with fewer detections and less telemetry than Windows estates, yet MITRE ATT&CK catalogues a steady line of macOS backdoors, stealers, adware droppers and miners that behave in very predictable ways. This hub groups the 22 macOS malware entries in ATT&CK Enterprise v20 into one catalogue, works out which behaviours they share from ATT&CK's own technique mappings, and turns those shared behaviours into detection and hardening themes. It is written for detection engineers, Mac administrators and threat intelligence analysts who need to know what the catalogue says before writing rules or reviewing an MDM baseline. For a single current stealer family in depth, see the Atomic macOS Stealer Guide; this page stays at catalogue level.

Key takeaways

• Persistence is the most reliable signal: 15 of the 22 entries map to T1543 Create or Modify System Process, 14 of them through T1543.001 Launch Agent, so new property lists in LaunchAgents and LaunchDaemons folders are the highest value detection point on a Mac.
• Shell and AppleScript do the work: 14 entries use T1059 Command and Scripting Interpreter, mostly T1059.004 Unix Shell, with AppleScript and Python behind it, so process ancestry from an app bundle to sh, bash, zsh, osascript or python is worth collecting.
• Credentials are a primary target: eight entries use T1555 Credentials from Password Stores (five through T1555.001 Keychain) and eight use T1056.002 GUI Input Capture, the fake password prompt that hands the attacker the login password and unlocks the keychain.
• Trust controls are attacked directly: eight entries map to T1553 Subvert Trust Controls, six of them T1553.001 Gatekeeper Bypass, so quarantine attribute removal and unsigned or ad hoc signed binaries launching from user folders deserve alerts.
• Most entries have no named actor: only six of 22 are linked to a group in ATT&CK (APT28, APT32, Daggerfly, Lazarus Group, Scarlet Mimic and Windshift), which is a reminder that commodity adware and stealers, not only state actors, reach managed Macs.

What this category covers and why it matters

The category holds every ATT&CK Enterprise v20 software entry whose only listed platform is macOS: 22 entries, all typed as malware, none as tools. They range from early OS X trojans such as Janicab and CallMe, through the 2017 wave of spyware described by Objective-See (FruitFly, MacSpy, Proton, iKitten), to modular families such as XCSSET, MacMa and Cuckoo Stealer that carry 26 to 33 technique mappings each. Cross-platform families that also run on macOS, such as LoudMiner and GlassWorm, sit in the ATT&CK Botnets, Worms and Cryptominers Software Hub instead, because their defining behaviour is spread or mining rather than the Mac platform.

The catalogue matters for two reasons. First, it is the shared vocabulary vendors and CTI teams use, so mapping your Mac detections to these technique IDs lets you measure coverage against real families rather than against a generic list. Second, the members cluster heavily: a small number of behaviours (launchd persistence, shell execution, hidden files, keychain and browser theft, Gatekeeper bypass) appear again and again, so a handful of well tuned detections covers most of the catalogue.

The entries fall into four practical groups:

• State linked backdoors: XAgentOSX and Komplex (APT28), OSX_OCEANLOTUS.D (APT32), Cryptoistic (Lazarus Group), MacMa (Daggerfly), WindTail (Windshift) and CallMe (Scarlet Mimic). See the APT28 (Fancy Bear) Threat Actor Profile, the APT32 Threat Actor Profile Guide and the Lazarus Group Threat Actor Profile.
• Spyware and credential stealers: Calisto, Keydnap, Proton, MacSpy, FruitFly, iKitten, Dok and Cuckoo Stealer, focused on keychain contents, keystrokes, screenshots, microphone and browser data.
• Adware with backdoor features: OSX/Shlayer and Bundlore, which ATT&CK describes as adware but which between them map to Gatekeeper bypass (Shlayer), malicious browser extensions and user execution (both) and many backdoor behaviours (Bundlore, 23 mappings).
• Developer and crypto focused: XCSSET (spread through infected Xcode projects, mapped to T1195.001), CoinTicker, CookieMiner (exchange cookies and mining) and macOS.OSAMiner (Monero mining through run-only AppleScript).

Common behaviours across the catalogue

The table counts how many of the 22 entries ATT&CK maps to each parent technique (an entry counts once even if it uses several sub-techniques). It was computed from the v20 software-to-technique relationships, not estimated.

See the T1543 Create or Modify System Process Defensive Guide, the T1555 Credentials from Password Stores Defensive Guide and the MITRE ATT&CK T1553 Subvert Trust Controls for technique depth.

Catalogue: every macOS malware entry in ATT&CK v20

All 22 entries, alphabetical. Platforms and groups come from ATT&CK v20; "key techniques" shows up to four mappings chosen to show what is distinctive about each entry, not the full list. Follow the ID link for every mapping and its cited reports.

Detection themes that cover most of the catalogue

Apple describes three layers of built-in protection: preventing launch through the App Store or Gatekeeper with Notarization, blocking malware with Gatekeeper, Notarization and XProtect, and remediating malware that has run with XProtect, which uses YARA signatures and checks apps at first launch, when they change and when signatures update. Those layers stop much known malware, but they are not telemetry. Detection needs an EDR or logging agent built on Apple's Endpoint Security framework, plus MDM data. The themes below follow the behaviour table.

1. launchd persistence: alert on any new or changed property list in the three launchd folders where the program path points into a user writable or hidden location, or the label imitates Apple (com.apple.*) while the binary is not Apple signed. On macOS 13 and later, Background Task Management records these items and shows them under System Settings, General, Login Items; sfltool dumpbtm prints the current state for triage.
2. Script execution from app bundles and installers: baseline the parent processes that legitimately launch osascript, sh and python, then alert on anything else, especially chains ending in curl to a raw IP or a newly registered domain.
3. Fake password prompts and keychain access: alert on osascript invoking a dialog with hidden answer input, on the security tool dumping or exporting keychain items outside admin activity, and on unknown processes opening login.keychain-db or browser cookie and login databases.
4. Gatekeeper and quarantine tampering: alert when the com.apple.quarantine extended attribute is removed from a downloaded item by a script, and when ad hoc signed or unsigned binaries run from Downloads, /tmp or /Users/Shared.
5. Privacy permission grants: track TCC grants for Accessibility, Input Monitoring, Screen Recording and Full Disk Access to anything outside an allow list. See the macOS TCC and Privacy Permissions Management Guide.
6. Self deletion and hidden files: a newly executed binary that deletes its own file within seconds, or a dot-prefixed executable in Application Support, is rare in legitimate software and cheap to alert on.

The macOS Detection and Response Guide covers the telemetry pipeline and the macOS LOOBins page covers built-in binaries that these families abuse. When a detection fires, the macOS Forensics Guide covers collection.

Hardening that breaks the common chains

Baseline settings are covered in the macOS CIS and mSCP Compliance Guide and the macOS Security Guide for Enterprises.

Where identity fits

Several catalogue entries are identity attacks in Mac clothing. Calisto, iKitten, MacMa, Proton and Cuckoo Stealer map to T1555.001 Keychain, and Keydnap reads keychain secrets from securityd memory (T1555.002), and CookieMiner (T1539 Steal Web Session Cookie) and XCSSET take browser cookies, which bypass MFA because the session is already authenticated. On developer Macs the same files hold machine credentials: cloud CLI profiles, SSH keys, Git and package registry tokens. Treat a confirmed stealer on a developer laptop as a non-human identity incident: revoke sessions, rotate every token and key that was readable by the user, and check the issuing platforms for use from new locations. See the MITRE ATT&CK T1539 Steal Web Session Cookie and the Developer Workstation and IDE Security Guide.

Rolling this out

1. Inventory telemetry: confirm every Mac runs an agent with Endpoint Security events for process exec, file create and rename, and that MDM reports OS version, Gatekeeper state and login items.
2. Map current rules: tag existing Mac detections with the technique IDs in the behaviour table and mark gaps, starting with T1543.001, T1059.004, T1553.001 and T1555.001.
3. Write in audit first: run new launchd, quarantine and keychain rules as alert only for two to four weeks on a pilot ring that includes developers, who generate the most legitimate noise.
4. Tune and promote: allow list by team identifier rather than path, then promote to blocking where the agent supports it.
5. Test with known behaviours: validate each rule with a benign emulation of the technique in a lab Mac, never with live samples on production devices.
6. Roll back safely: keep blocking rules in a separate policy so they can be returned to audit without losing the detection.

Measuring coverage

• Technique coverage: share of the 11 behaviour table techniques with at least one tested detection.
• Telemetry health: percentage of managed Macs reporting Endpoint Security events in the last 24 hours.
• Unmanaged persistence: count of login items and launchd entries not covered by the Managed Login Items allow list, trending down.
• Admin exposure: percentage of Mac users with standing local admin rights.
• Patch latency: median days from macOS security release to 90 per cent fleet adoption.

Common failure patterns

• Treating XProtect as the detection layer: it blocks known signatures but does not give the SOC process trees or alerts for new variants.
• Allow listing by path: many families install under names that imitate Apple or legitimate updaters (T1036.005 appears in four entries), so path based exclusions hide them.
• Ignoring adware detections: Shlayer is mapped to Gatekeeper bypass and Bundlore to script execution and launchd persistence; an adware alert proves the user can run untrusted code and that a stealer would have worked too.
• Developers with permanent admin and no build isolation: XCSSET shows that an infected project can execute at build time on the machine that holds signing keys and tokens.
• Not rotating after a stealer: cleaning the Mac without revoking cookies and tokens leaves the attacker's copies valid.

Framework mapping

Practitioner checklist

• Confirm Endpoint Security based telemetry on every managed Mac and alert on agents that stop reporting.
• Detect new launchd property lists pointing to user writable or hidden paths.
• Deploy a Managed Login Items payload and review unmanaged background items weekly.
• Alert on osascript password dialogs and on non-Apple processes reading the login keychain or browser databases.
• Alert on quarantine attribute removal and on unsigned code running from Downloads or /tmp.
• Remove standing admin rights and use logged elevation.
• Pre-approve TCC services through PPPC profiles only for named tools.
• Build untrusted Xcode projects in disposable environments.
• Rotate tokens, keys and sessions after any stealer detection on a Mac.

Standards and references

• MITRE ATT&CK: Software
• MITRE ATT&CK: T1543.001 Launch Agent
• MITRE ATT&CK: T1553.001 Gatekeeper Bypass
• MITRE ATT&CK: T1555.001 Keychain
• Apple: Protecting against malware in macOS
• Apple: Manage login items and background tasks on Mac
• NIST: SP 800-53 Rev 5 Security and Privacy Controls
• CIS: Critical Security Controls v8.1

Related NHI Mgmt Group resources: Atomic macOS Stealer Guide · macOS Detection and Response Guide · macOS Forensics Guide · ATT&CK Credential and Active Directory Attack Tools Software Hub