Introduction

Do Macs even get malware? If we’re to believe an Apple marketing claim once posted on Apple.com, apparently, no:

[Mac] doesn’t get PC viruses. A Mac isn’t susceptible to the thousands of viruses plaguing Windows-based computers. That’s thanks to built-in defenses in Mac OS X that keep you safe without any work on your part.1

Of course, this statement was rather deceptive and to Apple’s credit has long been removed from their website. Sure, there may be a kernel of truth in it; due to inherent cross-platform incompatibilities (not Apple’s “defenses”), a native Windows virus cannot typically execute on macOS. But cross-platform malware has long targeted both Windows and macOS. For example, in 2019 Windows adware was found packaged with a cross-platform framework that allowed it to run on macOS.2

Regardless of any marketing claims, Apple and malware have a long history of coexisting. In fact, Elk Cloner, the first “wild virus for a home computer,” infected Apple operating systems.3 Since then, malware targeting Apple computers has continued to flourish. Today it’s no surprise that Mac malware is an ever-growing threat to both end users and enterprises.

There are many reasons for this trend, but one simple reason is that as Apple’s share of the global computer market grows, Macs become an ever more compelling target to opportunistic hackers and malware authors. According to Gartner, Apple shipped over 6 million Macs in the second quarter of 2021 alone.4 In other words, more Macs means more targets for more Mac malware.

Moreover, although we often think of Macs as primarily consumer-focused machines, their presence in the enterprise is rapidly increasing. A report from early 2020 that studied this trend notes that Apple’s systems are now in use “across the Fortune top 500.”5 Such an increase unfortunately also begets an increase in sophisticated malware designed specifically to target the macOS enterprise, for purposes such as industrial espionage.

And although Apple’s market share still largely lags Microsoft’s, some research indicates that malicious threats target Macs equally, if not more. For example, Malwarebytes noted the following in their “2020 State of Malware Report”:

And for the first time ever, Macs outpaced Windows PCs in number of threats detected per endpoint.6

An interesting trend, and one that aligns with the ever-growing popularity of macOS, is attackers porting their Windows malware to macOS so that it will run natively on Apple’s desktop platform. In fact, in 2020 over half of the newly discovered, unique macOS malware “species” originated on Windows or a non-macOS platform.7 Recent examples of malware specimens that now have macOS variants include Mami, Dacls, FinSpy, IPStorm, and GravityRAT.

And why wouldn’t malware authors port their Windows or Linux malware to macOS? Such malware is already feature-complete and tested in the wild on the other operating systems. By taking this malware and either porting it to (or simply recompiling it for) macOS, attackers immediately gain compatibility with a whole new set of targets.

On the flip side, attackers also appear to be investing in macOS-specific malware. For example, a report from 2020 highlights the growing number of Mac-specific malware attacks created by highly knowledgeable macOS hackers:

All of the samples reviewed above have appeared in the last eight to ten weeks and are evidence that threat actors . . . are themselves keeping up-to-date with the Apple platform. These are not actors merely porting Windows malware to macOS, but rather Mac-specific developers deeply invested in writing custom malware for Apple’s platform.8

As illustrated in the following examples, these developments have led to an increase in the sophistication of attacks and malware used against macOS and its users.

Use of zero-days

  1. In a write-up titled “Burned by Fire(fox): a Firefox 0day Drops a macOS Backdoor,” I wrote about how attackers leveraged a Firefox zero-day to persistently deploy a persistent macOS implant.9

    In another report that analyzed a different piece of macOS malware, TrendMicro researchers noted,

    We have discovered an unusual infection . . . Most notable in our investigation is the discovery of two zero-day exploits: one is used to steal cookies via a flaw in the behavior of Data Vaults, another is used to abuse the development version of Safari.10

Sophisticated targeting

  1. In a recent attack by the WindShift APT group, researchers noted that “WINDSHIFT was observed launching sophisticated and unpredictable spear-phishing attacks against specific individuals and rarely targeting corporate environments.”11

    In another case, researchers at Google uncovered an attack specifically “targeting visitors to Hong Kong websites for a media outlet and a prominent pro-democracy labor and political group.”12 Attributed to nation-state attackers, the attack (which also leveraged a zero-day exploit) sought to surreptitiously infect macOS users whose political views diverged from those in power.

Advanced stealth techniques

  1. In a report on a recent Lazarus APT Group macOS implant, I noted that the group’s capabilities continue to evolve, as evidenced in “a new sample with the ability to remotely download and execute payloads directly from memory,” thus thwarting various file-based security tools.”13

    In “FinFisher Filleted,” yet another write-up on a piece of sophisticated macOS malware, I discussed the use of a kernel-level rootkit component. I noted that the rootkit “contains the logic to remove the target process of interest, by unlinking it from the (process) list. Once removed, the process is now hidden.”14

Bypassing recent macOS security features

  1. In a detailed report, “All Your Macs Are Belong To Us,” on a vulnerability now patched as CVE-2021-30657, I wrote about how malware was exploiting this flaw to run unsigned and unnotarized code, “bypassing all File Quarantine, Gatekeeper, and Notarization requirements.”15

    Recently I analyzed another piece of macOS malware that had been inadvertently notarized by Apple. As discussed in my analysis, once notarized, “these malicious payloads are allowed to run . . . even on macOS Big Sur.”16

The cause of this increased attack sophistication is up for debate: Does it come in response to Mac users becoming more threat-savvy (read: less naive)? Or is it due to the increased availability of advanced macOS security tools, an improvement to the core security of macOS, or a combination thereof?

Let’s conclude this section with a well-articulated statement from a Kaspersky “Threats to macOS users” report, which sums up the Macs versus malware debate:

Our statistics concerning threats for macOS provide fairly convincing evidence that the stories about this operating system’s complete safety are nothing more than that. However, the biggest argument against the idea that macOS (and iOS as well) is invulnerable to attack is the fact that there already have been attacks against individual users of these operating systems and groups of such users. Over the past few years, we have seen at least eight campaigns whose organizers acted on the presumption that the users of MacBook, iPhone, and other devices do not expect to encounter malware created specifically for Apple platforms.17

All in all, it’s clear that Mac malware is here to stay—in increasingly sophisticated and insidious ways.

Who Should Read This Book?

You! If you’re holding this book in your hands, by all means keep reading. While a basic understanding of cybersecurity fundamentals, or even malware basics, may help you get the most out of this book, they are not prerequisites. That said, this book was written with particular groups in mind, including, but not limited to:

What You’ll Find in This Book

Comprehensively analyzing Mac malware requires an understanding of many topics and the mastery of many skills. To cover these in a hands-on manner, this book is divided into three parts.

In Part 1, Mac Malware Basics, we’ll cover foundational topics, including Mac malware’s infection vectors, methods of persistence, and capabilities.

In Part 2, Mac Malware Analysis, we’ll transition into more advanced topics, such as static and dynamic analysis tools and techniques. The former involves examining a sample without executing it using various tools. Static analysis often finishes with a disassembler or decompiler. Dynamic analysis is the analysis of a malicious sample while it is executing, using passive monitoring tools as well as a debugger.

In Part 3, Analyzing EvilQuest, you’ll apply all that the book has taught you by walking through a thorough analysis of a complex Mac malware specimen, EvilQuest. This hands-on section illustrates how you, too, can analyze even sophisticated malware specimens.

Armed with this knowledge, you’ll be well on your way to becoming a proficient Mac malware analyst.

A Note on Mac Malware Terminology

Oxford Languages defines malware as follows:

Software that is specifically designed to disrupt, damage, or gain unauthorized access to a computer system.18

You can think of malware simply as any software written with malicious intent.

As with anything in life, there are always shades of gray. For example, consider adware that has been packaged with shareware and installed only after a user clicks “allow” without reading a long agreement. Is this considered malware? The adware authors would argue no; they might go as far as claiming their software provides a service to the user, such as ads of interest. This argument might seem absurd, but even the antivirus industry refers to such software as “potentially unwanted software” in an attempt to avoid legal challenges.

In the context of this book, such classifications are largely irrelevant, as my goal is to provide you with the tools and techniques to analyze any program, binary, or application, regardless of its malicious nature.

A Note on Safely Analyzing Malware

This book demonstrates the use of many hands-on techniques for analyzing Mac malware. In Part 3 of the book, you can even follow along in an analysis of a malware specimen called EvilQuest. But because malware is malicious, it should be handled with the utmost of care.

As malware analysts, we’ll often want to purposely run the malware during the course of our research. By executing the malware under the watchful eye of various dynamic analysis and monitoring tools, we will be able to gain an understanding of how a malicious sample can infect a system and persistently install itself, and what payloads it then deploys. But, of course, this analysis must be done in a tightly controlled and isolated environment.

One approach is to use a standalone computer as a dedicated analysis machine. This machine should be set up in the most minimal of ways, with services such as file sharing disabled. In terms of networking, the majority of malware will require internet access to fully function (for example, to connect to a command and control server for tasking). Thus, this analysis machine should be connected to the network in some manner. At a minimum, it is recommended that network traffic be routed through a VPN to mask your location.

However, there are downsides to leveraging a standalone computer for your analysis, including cost and complexity. The latter becomes especially apparent if you want to revert the analysis system to a clean baseline state (for example, to re-run a sample, or when analyzing a new specimen). Though you could just reinstall the OS, or if using Apple File System (APFS), revert to a baseline snapshot, these are both rather time-consuming endeavors.

To address these drawbacks, you can instead leverage a virtual machine for your analysis system. Various companies, such as VMWare and Parallels, offer virtualized options for macOS systems. The idea is simple: virtualize a new instance of the operating system that can be isolated from your underlying environment and, most notably, reverted to its original state at the click of a button. To install a new virtual machine, follow the instructions provided by each vendor. This typically involves downloading an operating system installer or updater, dragging and dropping it into the virtualization program, and then clicking through the remaining setup.

Before performing any analysis, make sure you disable any sharing between the virtual machine and the base system. It would be rather unfortunate to run a ransomware sample, only to find that it had been able to encrypt files on your host system via shared folders! Virtual machines also offer options for networking, such as host-only and bridged. The former will allow only network connections with the host, which may be useful in various analysis situations, such as when you’re setting up a local command and control server.

As noted, the ability to revert a virtual machine to its original state can greatly speed up malware analysis by allowing you to revert to different stages in the process. First, you should always take a snapshot before you begin your analysis so that when the analysis is complete, you can bring the virtual machine back to a known clean slate. During your analysis session, you should also make judicious use of snapshots, such as just prior to allowing the malware to execute some core logic. If the malware fails to perform the expected action (perhaps because it detected one of your analysis tools and prematurely exited), or if your analysis tools failed to gather the data you required for your analysis, no problem. Simply revert to the snapshot, make any necessary changes to your analysis environment or tools, and then allow the malware to re-execute.

The main drawback to the virtual machine analysis approach is that malware may contain anti-VM logic. Such logic attempts to detect if the malware is running within a virtual machine. If the malware is able to successfully detect that it is being virtualized, it will often exit in an attempt to thwart continued analysis. See Chapter 9 for approaches to identifying and overcoming this logic and continuing your VM-based analysis unabated.

For more information about setting up an analysis environment, including the specific steps for setting up an isolated virtual machine, see “How to Reverse Malware on macOS Without Getting Infected.”19

Additional Resources

For further reading, I recommend the following resources.

Books

The following list contains some of my favorite books on topics such as reverse engineering, macOS internals, and general malware analysis:

Websites

There used to be a dearth of information about Mac malware analysis online. Today, the situation has greatly improved. Several websites collect information on this topic, and blogs such as my very own Objective-See are dedicated to Mac security topics. The following is a non-exhaustive list of some of my favorites:

Downloading This Book’s Malware Specimens

If you want to delve deeper into the book’s material or follow along in a hands-on manner (which I highly recommend), the malware specimens referenced in this book are available for download from Objective-See’s online malware collection.20 The password for the specimens in the collection is infect3d.

It’s worth reiterating that this collection contains live malware. Please don’t infect yourself! Or if you do, at least don’t blame me.

Endnotes