Proton

First seen

2017-03-01 00:00:00

Malware type

backdoor, credential-stealer, spyware

Family

Malware family

Operating systems

macos

Related IoCs

214 (188 malicious)

Last IoC activity

2026-10-17 04:28:40

Profile updated

2026-07-07 13:41:23

Targeted industries: financial-services technology-and-telecommunications retail-and-hospitality

Context

Proton is a macOS backdoor focusing on data theft and credential access.

Recent IoC activity

186 malicious indicators in Maltiverse are attributed to Proton (S0279). The 20 most recently updated:

Detection coverage

• 231 Sigma rules

Malware & tools used

• GUI Input Capture (attack-pattern)
• Launch Agent (attack-pattern)
• File Deletion (attack-pattern)
• VNC (attack-pattern)
• Sudo and Sudo Caching (attack-pattern)
• Keychain (attack-pattern)
• Disable or Modify Tools (attack-pattern)
• Clear Linux or Mac System Logs (attack-pattern)
• Deobfuscate/Decode Files or Information (attack-pattern)
• Credentials from Web Browsers (attack-pattern)
• Keylogging (attack-pattern)
• Password Managers (attack-pattern)
• Screen Capture (attack-pattern)
• Archive Collected Data (attack-pattern)
• Unix Shell (attack-pattern)

Reports & references

• objective-see.com — Blog 0X25 (report)
• ransomlook.io — Proton (report)
• MITRE ATT&CK — S0279 (report)

External references

• mitre-attack — S0279
• Proton
• objsee mac malware 2017
• misp-galaxy
• misp-galaxy
• misp-galaxy