ChillyHell: A New macOS Backdoor Bypassed Apple Notarization for Years

ChillyHell is a new macOS backdoor from a modular malware family that bypassed Apple’s notarization for years, according to Jamf Threat Labs. The sample, which masquerades as a legitimate app bundle (applet[.]app) and is a Mach-O executable, was notarized by Apple and trusted by macOS Gatekeeper for years, yet remains overlooked by many antivirus vendors.

Jamf Threat Labs noted that the malware connects to attacker‑controlled infrastructure over HTTP and DNS TXT queries, using hardcoded IPs such as 93.88.75[.]252 and 148.72.172[.]53 with multiple ports for redundancy, and it features a multi‑stage execution loop that fetches tasks, deduplicates jobs, and runs modules. Its modules include a backconnect shell, an updater, a loader, and a brute‑force module that downloads a tool called kerberos and related wordlists to target local user credentials.

The threat was first mentioned in a private 2023 Mandiant report and was uploaded to VirusTotal in May 2025, with the sample publicly hosted on Dropbox since then, while research highlighted its persistence mechanisms like LaunchAgent, LaunchDaemon, and shell‑profile injections. For enterprises and individuals, the discovery underscores the need for multi‑layered defenses beyond Apple’s built‑in protections.