Janicab
MITRE ATT&CK: S0163 View on attack.mitre.org
Aliases: Janicab
- First seen
- 2013-07-01 00:00:00
- Malware type
- trojan
- Family
- Malware family
- Operating systems
- macos
- Profile updated
- 2026-07-07 15:30:14
Targeted industries: media-and-entertainment
Context
Janicab is an OS X trojan that relied on a valid developer ID and oblivious users to install it.
Detection coverage
- 1 YARA rules
- 22 Sigma rules
Malware & tools used
- Cron (attack-pattern)
- Audio Capture (attack-pattern)
- Code Signing (attack-pattern)
- Screen Capture (attack-pattern)
Detection rules
- SIGNATURE_BASE_MAL_Janicab_LNK (yara-rule)
Reports & references
- MITRE ATT&CK — S0163 (report)
- web.archive.org — New Signed Malware Called Janicab (report)