XAgentOSX

MITRE ATT&CK: S0161 View on attack.mitre.org

Aliases: OSX.Sofacy, XAgentOSX

First seen: 2014-01-01 00:00:00
Malware type: trojan, rat
Family: Malware family
Operating systems: macos
Profile updated: 2026-07-07 13:20:04

Targeted industries: government-and-public-sector defense-and-aerospace

Targeted regions: country_code:us country_code:de country_code:fr

Context

XAgentOSX is a trojan that has been used by APT28 on OS X and appears to be a port of their standard CHOPSTICK or XAgent trojan.

Detection coverage

131 Sigma rules

Malware & tools used

Keylogging (attack-pattern)
System Owner/User Discovery (attack-pattern)
File and Directory Discovery (attack-pattern)
File Transfer Protocols (attack-pattern)
Credentials from Web Browsers (attack-pattern)
Process Discovery (attack-pattern)
Screen Capture (attack-pattern)
System Information Discovery (attack-pattern)
File Deletion (attack-pattern)
Native API (attack-pattern)

Used by threat actors

APT28 (threat-actor)

Reports & references

Broadcom/Symantec — Apt28 Espionage Military Government (report)
MITRE ATT&CK — S0161 (report)
researchcenter.paloaltonetworks.com — Unit42 Xagentosx Sofacys Xagent Macos Tool (report)

External references