SOCRadar · Published 12 Oct
Inside ICMacOS: From an Infostealer to a Persistent RAT
By ST SOCRadar Threat Research Unit (STRU)
Excerpt
Over the past few years, Apple’s enterprise footprint has expanded significantly, with macOS capturing an important share of the global desktop operating system market. Modern enterprise adoption has surged, particularly in the United States, where roughly one in three software developers works on macOS.
Naturally, this rapid adoption has turned Mac environments into high-value targets for cybercriminals. Threat telemetry also reflects this, showing a sharp rise in macOS-directed attacks, highlighted by a surge in infostealer variants and detections. Lowering the barrier to ent…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by SOCRadar on socradar.io.
Mentioned in the excerpt1
More from SOCRadar7
SOCRadar · Web page · Published 20 Oct
INC and The Gentlemen Ransomware: Exposed AI Infrastructure
SOCRadar Threat Research Unit (STRU) has uncovered an AI-driven intrusion ecosystem run by affiliates of the INC Ransomware and The Gentlemen Ransomware groups. A single publicly accessible command-and-control server exposed the operators’ AI session…
SOCRadar · Web page · Published 3 Aug
Introducing DOUBLECUP, a ClickFix Loader Delivering CountLoader and DeviceManager RATs
The DOUBLECUP panel provides multiple utilities to load an operator’s final payload. The first stage drops a steganographic PNG image into the browser’s cache, retrieves its hidden content, and executes the second stage. This second stage decrypts the final…
SOCRadar · Web page · Published 28 Jul
Dark Web Profile: ExfilSquad
ExfilSquad is an emerging data-extortion group that surfaced with a rapid wave of public claims and a Tor-hosted Data Leak Site (DLS). The group is associated with an “only exfiltration” model, suggesting a focus on data theft rather than confirmed file…
SOCRadar · Web page · Published 18 Mar
Dark Web Profile: ShinyHunters
[Update] July 31, 2025: “ShinyHunters Behind CRM Attacks on Qantas, Adidas, and Others” Within the obscured world of the Deep/Dark Web, where cybercrime flourishes amidst databases, initial access brokers, and a plethora of illegal activities, there exists a…
On the same topics
russianpanda.com · Web page · Published 26 Dec
Pure Logs Stealer Fails to Impress
Pure Logs Stealer first appeared on hacking forums at the end of October 2022. The stealer is developed by a malware developer going under the alias PureCoder. The malware developer is also behind in developing the products shown above, such as Pure Miner,…
Check Point · Web page · Published 27 Mar
Rhadamanthys: The “Everything Bagel” Infostealer
Rhadamanthys is an advanced infostealer which debuted on the dark web in September of last year to a warm critical reception by cybercriminals. A maximalist approach to features: functionality is added for its own sake, never mind the effort required or…
Varonis · Web page · Published 22 Oct
StealC Is Back, and This Time It's a RAT
In June, Europol tore down StealC, a prominent infostealer, as part of Operation Endgame. International authorities seized 326 servers and 142 domains, recovered more than 25 million stolen credentials from 385,000 infected machines, and pulled the plug on…
ETDA Threat Group Cards · Web page · Added 25 Oct
Threat Group Cards: A Threat Actor Encyclopedia
Home > List all groups > List all tools > List all groups using tool Retefe (Android) Tool: Retefe (Android) Names Retefe (Android) Category Malware Type Banking trojan, Backdoor, Info stealer, Credential stealer, Botnet (GovCERT.ch) Recently, some anti-virus…