Dormant macOS Backdoor ChillyHell Resurfaces

Dormant macOS Backdoor ChillyHell has resurfaced in a new version, described by researchers as a modular backdoor that can brute-force passwords, drop payloads and communicate with C2 infrastructure. Jamf Threat Labs says a new ChillyHell sample uploaded to VirusTotal on 2 May was notarised by Apple in 2021, and the sample matches the version Mandiant reported in 2023 that was used in the Ukrainian attack the year before.

The malware has three persistence mechanisms, including launching as a LaunchAgent with a plist at ~/Library/LaunchAgents/com.apple.qtop.plist and the main binary at ~/Library/com.apple.qtop/qtop, a system LaunchDaemon with a plist at /Library/LaunchDaemons/com.apple.qtop.plist and a main binary at /usr/local/bin/qtop, and a third method that injects a shell configuration to run on every new terminal session.

It can retrieve sensitive data, exfiltrate information and execute commands from the attacker-controlled C2, with features such as local password cracking and timestamping to hide traces, according to Jamf researchers. Apple revoked the notarisation of the developer certificates once notified by Jamf about the malware on Dropbox and the VirusTotal sample, researchers noted, and the report provides IoCs to help defenders identify signs of the backdoor.

According to Jamf Threat Labs, ChillyHell’s multiple persistence options and its ability to operate under different privileges highlight macOS as an increasingly important attack surface for enterprises.