iKitten

MITRE ATT&CK: S0278 View on attack.mitre.org

Aliases: OSX/MacDownloader, iKitten

First seen
2017-01-01 00:00:00
Malware type
spyware
Family
Malware family
Operating systems
macos
Profile updated
2026-07-07 13:41:21

Targeted industries: government-and-public-sector defense-and-aerospace

Targeted regions: country_code:us country_code:ir

Context

iKitten is a macOS exfiltration agent also known as OSX/MacDownloader. It is designed to steal sensitive information from targeted systems within specific industries such as government and defense.

Detection coverage

  • 39 Sigma rules

Malware & tools used

  • System Network Configuration Discovery (attack-pattern)
  • GUI Input Capture (attack-pattern)
  • Process Discovery (attack-pattern)
  • Archive via Utility (attack-pattern)
  • Hidden Files and Directories (attack-pattern)
  • Keychain (attack-pattern)
  • RC Scripts (attack-pattern)

Reports & references

  • objective-see.com — Blog 0X25 (report)
  • MITRE ATT&CK — S0278 (report)

External references