Keydnap

MITRE ATT&CK: S0276 View on attack.mitre.org

Aliases: OSX/Keydnap, Keydnap

First seen
2016-07-01 00:00:00
Malware type
backdoor, credential-stealer
Family
Malware family
Operating systems
macos
Profile updated
2026-07-07 14:37:10

Targeted industries: technology-and-telecommunications

Context

This piece of malware steals the content of the user's keychain while maintaining a permanent backdoor.

Detection coverage

  • 45 Sigma rules

Malware & tools used

  • Multi-hop Proxy (attack-pattern)
  • Web Protocols (attack-pattern)
  • Securityd Memory (attack-pattern)
  • Resource Forking (attack-pattern)
  • Setuid and Setgid (attack-pattern)
  • GUI Input Capture (attack-pattern)
  • Space after Filename (attack-pattern)
  • Python (attack-pattern)
  • Launch Agent (attack-pattern)

Reports & references

  • objective-see.com — Blog 0X16 (report)
  • malpedia.caad.fkie.fraunhofer.de — Osx.Keydnap (report)
  • ESET — New Osxkeydnap Malware Hungry Credentials (report)
  • ESET — Osxkeydnap Spreads Via Signed Transmission Application (report)
  • github.com — Keydnap (report)
  • MITRE ATT&CK — S0276 (report)
  • objective-see.org — Blog 0X16 (report)
  • ESET — New Osxkeydnap Malware Hungry Credentials (report)

External references