Malware
macOS.OSAMiner
S1048 · macOS
macOS.OSAMiner is a Monero mining trojan that was first observed in 2018.
security researchers assessed macOS.OSAMiner may have been circulating since at least 2015. macOS.OSAMiner is known for embedding one run-only AppleScript into another, which helped the malware evade full analysis for five years due to a lack of Apple event (AEVT) analysis tools.
ATT&CK S1048
Malware family
Sigma rules0
YARA rules0
Live IOCs0
▤
Techniques Used
11ATT&CK techniques this malware is documented performing. Each links to its detections - Sigma, vendor SIEM rules, and analytics - so you catch the behaviour even when the binary changes.
⚊
Live Indicators
Indicators are defanged for safe handling. Newest first.
Aliases
macOS.OSAMiner
External lookups - second-class, for what we don’t hold ourselves