CHILLYHELL macOS Backdoor and ZynorRAT RAT Threaten macOS, Windows, and Linux Systems

Cybersecurity researchers have unveiled two new malware families: a modular Apple macOS backdoor called CHILLYHELL and a Go-based remote access Trojan named ZynorRAT that can target Windows and Linux as well. According to Jamf Threat Labs, CHILLYHELL is written in C++ for Intel architectures and is linked to UNC4487, an uncategorised threat cluster assessed to have been active since at least October 2022.

The Apple device management company said a CHILLYHELL sample was uploaded to VirusTotal on 2 May 2025, with certificates revoked after Apple notarised the artifact in 2021 and hosted publicly on Dropbox. Once executed, CHILLYHELL profiles the host, establishes persistence via LaunchAgent or LaunchDaemon, and can alter shell configuration files to ensure it restarts; it also uses timestomping to disguise artefacts and communicates with a hard-coded C2 server over HTTP or DNS.

ZynorRAT, compiled with Go, targets Windows and Linux, offering file exfiltration, system enumeration, screenshot capture, and various persistence mechanisms, with a Telegram bot acting as its central C2 interface and the first VirusTotal submission dating to 8 July 2025.