Keydnap
MITRE ATT&CK: S0276 View on attack.mitre.org
Aliases: OSX/Keydnap, Keydnap
- First seen
- 2016-07-01 00:00:00
- Malware type
- backdoor, credential-stealer
- Family
- Malware family
- Operating systems
- macos
- Profile updated
- 2026-07-07 14:37:10
Targeted industries: technology-and-telecommunications
Context
This piece of malware steals the content of the user's keychain while maintaining a permanent backdoor.
Detection coverage
- 45 Sigma rules
Malware & tools used
- Multi-hop Proxy (attack-pattern)
- Web Protocols (attack-pattern)
- Securityd Memory (attack-pattern)
- Resource Forking (attack-pattern)
- Setuid and Setgid (attack-pattern)
- GUI Input Capture (attack-pattern)
- Space after Filename (attack-pattern)
- Python (attack-pattern)
- Launch Agent (attack-pattern)
Reports & references
- objective-see.com — Blog 0X16 (report)
- malpedia.caad.fkie.fraunhofer.de — Osx.Keydnap (report)
- ESET — New Osxkeydnap Malware Hungry Credentials (report)
- ESET — Osxkeydnap Spreads Via Signed Transmission Application (report)
- github.com — Keydnap (report)
- MITRE ATT&CK — S0276 (report)
- objective-see.org — Blog 0X16 (report)
- ESET — New Osxkeydnap Malware Hungry Credentials (report)