ChillyHell macOS Malware: Three Methods of Compromise and Persistence

Jamf Threat Labs recently uncovered a developer-signed macOS backdoor, dubbed ChillyHell, on VirusTotal that uses sophisticated endpoint profiling and persists via several mechanisms while remaining notarised for years. The threat is a modular C++ backdoor that masquerades as an innocent applet and activates to collect environmental data, enumerate user accounts, and harvest environment variables before establishing C2 connectivity over DNS and HTTP to a hardcoded list of servers.

Persistence is achieved through a three-pronged approach: a LaunchAgent for user context, a LaunchDaemon for root/system context, and shell profile injection to run commands at terminal start; it even timestomps files to obscure age. The main control loop, mainCycle, continuously retrieves and executes attacker commands, including spawning reverse shells, downloading updates, and running local brute-force attacks against passwords with exfiltration of cracked credentials.

Notably, some samples were notarized by Apple, with the more robust eDrawMaxBeta variant stamped by TEAMID F645668Q3H and the chrome_render variant by TEAMID R868N47FV5; a 2021-notarised apptest sample (applet[.]app) reappeared in May 2025, remaining publicly hosted on Dropbox for years.