Jaron Bradley, Director of Jamf Threat Labs, is sharing their work on "ChillyHell: A Deep Dive into a Modular macOS Backdoor." Jamf Threat Labs uncovers a newly notarized macOS backdoor called ChillyHell, tied to past UNC4487 activity and disguised as a legitimate applet. The malware showcases robust host profiling, multiple persistence mechanisms, timestomping, and flexible C2 communications over both DNS and HTTP. Its modular design includes reverse shells, payload delivery, self-updates, and a brute-force component targeting user credentials. The research can be found here: ⁠ChillyHell: A Deep Dive into a Modular macOS Backdoor

Jamf's Threat Labs team has discovered a new variant of the macOS malware family "ChillyHell," previously documented only in limited circles and largely undetected by antivirus software. The malware still possesses an Apple developer signature from 2021 and remained active for an extended period without triggering alerts. ChillyHell is a modular C++ backdoor designed for Intel architectures, disguised as a legitimate macOS applet, but it does not function as such. The malware family's modular design allows attackers to enable remote access, drop additional payloads, or crack passwords using brute-force attacks. To avoid detection… Read more

Das Threat-Labs-Team von Jamf hat eine neue Variante der macOS-Malware-Familie „ChillyHell“ entdeckt, die zuvor nur in begrenzten Kreisen dokumentiert war und von Antivirensoftware weitgehend unbemerkt blieb. Die Malware verfügt nach wie vor über eine Apple-Entwicklersignatur aus dem Jahr 2021 und blieb lange Zeit aktiv, ohne Warnmeldungen auszulösen. ChillyHell ist eine modulare C++-Backdoor, die für Intel-Architekturen entwickelt wurde und als legitimes macOS-Applet getarnt ist, jedoch nicht als solches funktioniert. Durch das modulare Design der Malware-Familie können Angreifer den Fernzugriff aktivieren, zusätzliche Payloads ablegen oder Passwörter mit Brute-Force-Angriffen knacken. Um einer Erkennung... Der Beitrag Neue Variante entdeckt: macOS-Malware ChillyHell erschien zuerst auf B2B Cyber Security.

also known as HEUR:Trojan-Dropper.OSX.Agent.u Type: Hybrid Threat Platform: Mac OS 9 Last updated: 09/30/25 11:22 pm Threat Level: Medium Description ChillyHell is malicious software that infects macOS by disguising itself as a legitimate program. Once installed, it can download more malware and open a backdoor, allowing attackers to remotely control the computer, steal information, and more. ChillyHell Threat Removal MacScan can detect and remove ChillyHell Hybrid Threat from your system, as well as provide protection against other security and privacy threats. A 30-day trial is available to scan your system for this threat. Download MacScan The post ChillyHell appeared first on SecureMac.

(画像提供：Shutterstock) (画像提供：Shutterstock) ChillyHellは2021年に作成されたモジュール型のmacOSバックドアで、Appleの公証を通過し、何年も検出されなかった Mandiantが2023年に発見したが、情報は公開されず、ウイルス対策ツールも対応しなかった Jamfが2025年に公表し、現在も公証が有効でウイルス対策エンジンで検出されていないことを明らかにした 少なくとも4年間、モジュール型のApple向けマルウェアが、ウイルス対策ソリューションに検出されることなく、標的デバイスに展開されていた。 さらに悪いことに、少なくとも2年間は（一部の）サイバーセキュリティコミュニティがその存在を認識していた。 今週初め、セキュリティ研究者のJamfが新しいレポートを公開し、ChillyHellについて詳述した。これは、リバースシェルの提供、自身のアップデート、追加ペイロードの取得と実行が可能なモジュール型バックドアである。 2023年に初検出 バックドア自体は特別なものではないが、長期間検出されなかったことが注目に値する。どうやらこのマルウェアは2021年に作成され、Appleに提出された。その際、公証チェックを通過し、Appleの自動システムは悪意のあるものと判断しなかった。 チェックを通過できた理由は、ペイロードが複数のモジュールに分割されていたこと、有効なApple Developer IDで署名されていたこと、無害なアプリとして設計されていたことが挙げられる。さらに、権限昇格やネットワークスキャンなど、標準的な不審な挙動もなかった。 2023年までは主要なプラットフォームでウイルス対策による検出がなく、見過ごされていた。しかし2023年、Mandiant（Googleのサイバーセキュリティ部門）が脅威インテリジェンスブリーフィングでこれを特定し、ウクライナ当局者を自動車保険サイト経由で標的にしていたUNC4487という脅威アクターに帰属させた。 しかしこのブリーフィングは非公開で技術的な詳細もなく共有されたため、広範なセキュリティコミュニティはその存在を把握できなかった。Appleも公証を取り消さず、ウイルス対策ツールも依然として検出しなかった。 そして2025年、Jamf Threat Labsがこのマルウェアを公に公開し、「ChillyHell」と命名、アーキテクチャや永続性、回避技術について詳述した。さらに、この時点でもAppleの公証は有効なままであり、VirusTotalにアップロードされた一部サンプルは依然としてウイルス対策で検出されていないことを強調した。 出典： The Register 翻訳元:

  Jamf Threat Labs has published a new report highlighting the resurgence of Mac malware known as ChillyHell. Initially detected in 2021 and later privately disclosed by cybersecurity company Mandiant in 2023, the malware resurfaced this past May when Jamf identified a fresh sample on VirusTotal—a platform used for analyzing suspicious files and URLs. Once a Mac is compromised, ChillyHell can steal sensitive data such as usernames and passwords. What sets this malware apart is its ability to use timestomping—altering file timestamps—and its capability to switch C2 protocols to bypass detection. According to Jamf, “the developer certificates associated with ChillyHell have been revoked.” While this action restricts its ongoing development, it doesn’t mean the malware has completely disappeared from circulation. How Mac Users Can Stay Protected from Malware To minimize the risk of infection, avoid downloading applications from unverified sources such as GitHub or third-party websites. The Mac App Store remains the safest place to install apps, as Apple rigorously vets software before publishing. Alternatively, purchase apps directly from trusted developers via their official websites. Using cracked or pirated software dramatically increases the risk of malware exposure. Users should also avoid clicking links in unsolicited emails or messages. If a message appears legitimate, verify the sender’s email and check the link carefully. On a Mac, you can Control-click a link, choose Copy Link Address, and paste it into a text editor to preview the real URL before visiting. For additional security, Macworld offers resources such as a guide on whether antivirus software is necessary, a detailed list of Mac viruses and trojans, and a comparison of the best Mac security software available. Apple also provides built-in protections in macOS and releases regular security updates. Installing these updates promptly is essential, as Apple reissues corrected patches if any flaws are found.

ChillyHell, the macOS threat, is back and stealthier than ever. This malware bypasses security checks, disguises itself with clever tactics, and even opens a decoy Google page to avoid suspicion. It's like the James Bond of cyber threats, but instead of saving the world, it's here to control your Mac.

ChillyHell, a modular macOS backdoor, has been sneaking around undetected for years, slipping past Apple's notarization process like a ninja in a fruit aisle. Despite being flagged in 2023, it remained notarized and active. Researchers note its flexibility and stealth, reminding us: not all malicious code wears a villain's cape.

Sikkerhetsforskere gir en oppdatering på «Chillyhell».

: 'We do believe that this was likely the creation of a cybercrime group,' threat hunter tells The Reg

With multiple persistence mechanisms, the modular malware can brute-force passwords, drop payloads, and communicate over different protocols.

: 'We do believe that this was likely the creation of a cybercrime group,' threat hunter tells The Reg

: 'We do believe that this was likely the creation of a cybercrime group,' threat hunter tells The Reg

A previously dormant macOS threat, ChillyHell, is reviving. Read how this malware can bypass security checks, remain hidden,…

Apple introduce Memory Integrity Enforcement su macOS e iOS, combinando EMTE, PAC e allocatori tipizzati per neutralizzare backdoor come ChillyHell.

The ChillyHell malware, also identified as MATANBUCHUS, has re-emerged as a significant threat to macOS systems. This backdoor malware leverages Google.com as a decoy to circumvent security checks and maintain stealth on compromised systems. By exploiting trusted domains, ChillyHell effectively bypasses network-based detection mechanisms, allowing attackers to establish persistent remote access. A critical aspect of ChillyHell's evasion strategy is its utilization of stolen code-signing certificates. These certificates, typically employed to validate software authenticity and integrity, enable the malware to masquerade as legitimate applications. This tactic undermines traditional security measures that rely on code signing verification, complicating detection efforts. The resurgence of ChillyHell underscores the shifting threat landscape for macOS environments. While macOS has historically been perceived as a more secure platform, the increasing sophistication of macOS-targeted malware challenges this notion. Cybersecurity professionals must adapt their defensive strategies to address these advanced evasion techniques. To counter the threats posed by ChillyHell, organizations should deploy advanced detection methodologies, including behavioral analysis and anomaly detection. Implementing regular audits of code-signing certificates can aid in identifying and revoking compromised certificates. Furthermore, user education on the risks associated with downloading software from untrusted sources is paramount, as malicious actors often exploit stolen certificates to distribute malware disguised as legitimate applications. The re-emergence of ChillyHell has substantial implications for the cybersecurity landscape. It emphasizes the necessity for comprehensive security measures across all platforms, including macOS. Cybersecurity experts must remain abreast of emerging threats and continuously refine their defensive strategies to mitigate risks posed by sophisticated malware such as ChillyHell.

'We do believe that this was likely the creation of a cybercrime group,' threat hunter tells The Reg ChillyHell, a modular macOS backdoor believed to be long dormant, has likely been infecting computers for years while flying under the radar, according to security researchers who spotted a malware sample uploaded to VirusTotal in May.…

: 'We do believe that this was likely the creation of a cybercrime group,' threat hunter tells The Reg

: 'We do believe that this was likely the creation of a cybercrime group,' threat hunter tells The Reg