Cracked software beats gold: new macOS backdoor stealing cryptowallets

A month ago, we discovered some cracked apps circulating on pirating websites and infected with a Trojan proxy. The malicious actors repackaged pre-cracked applications as PKG files with an embedded Trojan proxy and a post-install script initiating the infection. We recently caught sight of a new, hitherto unknown, macOS malware family that was piggybacking on cracked software. The threat proved far more potent than an unauthorized proxy server installation.

Stage 1. Activator.app

The samples we found could be successfully run …

applications apps backdoor caught cracked cracked software embedded family files infection install macos macos backdoor macos malware malicious malicious actors malware proxy script software stealing trojan websites