Security analysts have exposed a sophisticated new infostealer dubbed ‘AppleProcessHub’ targeting macOS systems, with technical details revealing the malware’s tactics, techniques, and procedures (TTPs), as well as the infrastructure behind its operations.
First flagged by MalwareHunterTeam, the stealer deploys a multi-stage attack chain utilizing an initial Mach-O binary disguised as a dynamic library (libsystd.dylib) to execute payload delivery, data exfiltration, and command-and-control (C2) communications.
The malicious campaign employs a Mach-O binary file compiled for x86_64 architecture, masquerading under the .dylib extension but lacking the standard characteristics of a dynamic library.
Upon execution, this binary written in Objective-C leverages macOS’s Grand Central Dispatch for asynchronous task scheduling, strategically calling internal methods to query sensitive device information and establish persistence.
Payload Execution
Reverse engineering reveals that the entry point function (_start()) delegates control to [Task ccsys], which collects the device’s serial number using macOS IOKit routines like _IOServiceMatching("IOPlatformExpertDevice") and _IORegistryEntryCreateCFProperty().
This serial number is uniquely leveraged for tracking and C2 communications. The binary assembles its C2 endpoint dynamically by decrypting three embedded AES-128-ECB-encrypted base64 strings using the hardcoded key “CMKD378491212qwe”.
Decryption yields the full URL:https://www.appleprocesshub[.]com/v1/resource
This endpoint not only serves as a beacon for data exfiltration but also as a dropper mechanism for the next attack stage.
The Mach-O initiates a network request to download a bash script previously observed under filenames like fSidEOWW.sh which is then executed via NSTask with shell arguments, enabling arbitrary script execution.
Second Stage Bash Script
The downloaded bash script systematically harvests user artifacts including shell histories (bash_history, zsh_history), GitHub configs, SSH keys, /etc/hosts, and the macOS Keychain database (Login.keychain-db).
According to the Report, the script then archives these files into a zip archive, subsequently uploading the package to the attacker’s C2 infrastructure for further exploitation.
A key innovation in this stealer is its use of indirect Objective-C message sending and recursive C2 polling if no actionable command is received (i.e., payload is shorter than 10 bytes or the “enable” key in the decrypted JSON is false), the malware schedules subsequent C2 requests with delay, evading simple temporal detection.
The campaign’s C2 infrastructure, hosted at appleprocesshub[.]com, orchestrates payload delivery and data exfiltration, with dynamic command handling embedded in the JSON responses.
These responses dictate execution timing, payload activation (“enable” flag), and task-specific instructions.
The C2 server offline at analysis time demonstrates modular capabilities, potentially allowing the operator to swap in new scripts or tasks as needed.
The ‘AppleProcessHub’ stealer exemplifies advancing macOS malware TTPs: combining Objective-C dropper mechanics, AES-encrypted C2 endpoint construction, and multi-stage, script-driven data theft.
Its capability to pivot from individual credential theft to possible organizational compromise given the nature of harvested data underscores a heightened threat.
Security teams are urged to increase vigilance for indicators such as unexplained network connections to appleprocesshub[.]com, presence of suspicious Mach-O binaries with Objective-C internals, and sudden archiving of sensitive shell and credential files.
The case highlights the need for advanced behavioral monitoring and rapid patching strategies across Mac fleets as attackers increasingly target the macOS ecosystem.
Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.
