LightSpy macOS Spyware Used WebKit Exploits and 10 Data-Stealing Plugins
Summary
ThreatFabric details LightSpy’s macOS infection chain, two WebKit exploits, and 10 plugins for collecting data including files, Keychain contents, browser history, audio, and screen recordings. Researchers found a misconfigured operator panel but no confirmed real-world
Key points
- The macOS implant used CVE-2018-4233 and CVE-2018-4404 against macOS 10, with the first exploit delivering a downloader and later components establishing persistence.
- The spyware’s Core communicated with a control server, received commands, and could dynamically download or update plugins.
- Ten plugins could collect files, Keychain contents, browser history, Wi-Fi and nearby-device information, installed apps, and running processes; others enabled microphone, camera, screen recording, and remote-shell functions.
- Researchers found a misconfigured operator panel that exposed victim data and correlated with the implant’s plugin functions.
- The researchers assessed that the panel likely contained no real victims: many devices appeared to be test or researcher systems, and the campaign likely operated around 2022.
- The researchers found no evidence confirming LightSpy implants for Linux or routers.
Article Details
- Attack Vectors
- The macOS infection chain used publicly available exploits CVE-2018-4233 and CVE-2018-4404; the report describes CVE-2018-4233 triggering a WebKit vulnerability in Safari to achieve unprivileged code execution and deliver the next-stage payload.
- The downloaded payload launched a Bash script that used curl to retrieve additional files. The script decrypted and unpacked the payload, then used launchctl to establish startup persistence.
- A downloaded file named ssudo may have provided local privilege escalation, but the researchers did not retrieve it and describe this capability as a belief rather than a confirmed finding.
- The administration panel contained traces potentially related to DNS poisoning; the report does not confirm this as an attack vector.
- Defensive Notes
- Enforce authorization before serving administration-panel content. The report found that the panel checked authorization only after browser scripts had loaded, enabling access to victim information.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 103[.]27[.]109[.]217 | Control-server IP associated by the researchers with the macOS campaign. |
| SHA256 | 048ab442a2617f37c3145c0c2bdda057baa09e017a29e649f17d43c95a34e69f | SHA-256 listed for the ddss decryption binary in the infection chain. |
| SHA256 | 0f662991dbd0568fc073b592f46e60b081eedf0c18313f2c3789e8e3f7cb8144 | SHA-256 listed for an XOR-decoded LightSpy plugin sample. |
| SHA256 | 0f66a4daba647486d2c9d838592cba298df2dbf38f2008b6571af8a562bc306c | SHA-256 listed for the XOR-decoded LightSpy Core. |
| SHA256 | 18bad57109ac9be968280ea27ae3112858e8bc18c3aec02565f4c199a7295f3a | SHA-256 listed for an XOR-decoded LightSpy plugin sample. |
| SHA256 | 1d499c401d8854b6331d3b531fc57418dd2b132861e0448ae198dcbea41484ab | SHA-256 listed for the stage-0 exploit file offsets.js. |
| SHA256 | 21b099c7eadd1d6895e025f670fc660769e617794400f35c52b4726fc546cb68 | SHA-256 listed for a LightSpy AudioRecorder plugin sample. |
| SHA256 | 22b0f53bb7ff5047b2d2f77f9cc4f1a503bde2fa2b279fa999e48fb656c42782 | SHA-256 listed for a LightSpy BrowserHistory plugin sample. |
| SHA256 | 23d0b9ae73145106cffe56719526801e024092cd6d25b9628ae3d9995b0b5395 | SHA-256 listed for the update.plist persistence component. |
| SHA256 | 2b4fbd5aa06f70d84091d2f7cca4bd582237f1a1084835c3c031a718b6e283f9 | SHA-256 listed for an XOR-decoded LightSpy plugin sample. |
| SHA256 | 2c2471150aacc8443aa92a6063a848e8bb9dbcc8e369fb378c003d98bceaa728 | SHA-256 listed for the stage-0 exploit file Int64.js. |
| SHA256 | 3d6ef4d88d3d132b1e479cf211c9f8422997bfcaa72e55e9cc5d985fd2939e6d | SHA-256 listed for an XOR-decoded LightSpy plugin sample. |
| SHA256 | 4511567b33915a4c8972ef16e5d7de89de5c6dffe18231528a1d93bfc9acc59f | SHA-256 listed for an XOR-decoded LightSpy plugin sample. |
| SHA256 | 4607dfdd78fcb8d6bf94ecc34cf125f20e4ea94ac9fce002d9e7cd7956a707dd | SHA-256 listed for a LightSpy WifiList plugin sample. |
| SHA256 | 4b973335755bd8d48f34081b6d1bea9ed18ac1f68879d4b0a9211bbab8fa5ff4 | SHA-256 listed for the update file that serves as the macOS updater and orchestrator. |
| SHA256 | 5fb67d42575151dd2a04d7dda7bd9331651c270d0f4426acd422b26a711156b5 | SHA-256 listed for an XOR-decoded LightSpy plugin sample. |
| SHA256 | 65aa91d8ae68e64607652cad89dab3273cf5cd3551c2c1fda2a7b90aed2b3883 | SHA-256 listed for an XOR-decoded LightSpy plugin sample. |
| SHA256 | 65dee715b928f07da356e8bce7a762b0ab4c140ebea63e4bd66c2eb85e0fa2dc | SHA-256 listed for the 20004312341.png stage-1 downloader executable. |
| SHA256 | 75a571d33a7c11fb5515a08a46fcb67dabbcb3fd4cbf69894ab82e394e68679c | SHA-256 listed for a LightSpy CameraShot plugin sample. |
| SHA256 | 768f1cb8b8ac45c6e854f0320f833367cf7aa69279fd82aa1a6c3bc3d765ce7e | SHA-256 listed for the unXORed Bash script used to download further payload files. |
| SHA256 | 8a4f8a755ca123e9c3aa77b525f59ce99f1f2e288afc2e29afb6d15573776a16 | SHA-256 listed for the stage-0 exploit file index.html. |
| SHA256 | 97607d1b12d7234a42a62cdff4d6a7b2b5b93bf38d827b9e4448b0d7bd5da464 | SHA-256 listed for the mac.zip archive containing the updater and its plist. |
| SHA256 | ac6d34f09fcac49c203e860da00bbbe97290d5466295ab0650265be242d692a6 | SHA-256 listed for an XOR-decoded LightSpy plugin sample. |
| SHA256 | ba4d77387c7b5761893ca2b1e75b2d05733d3fbfb1bb3a2bad81cfc8f641545b | SHA-256 of the LightSpy Core sample identified as C40F0D27. |
| SHA256 | cf709c7b4c68e6d81f8239b4275dac8eb0b026f05934b81867e645dd389d65fb | SHA-256 listed for an XOR-decoded mac.zip payload. |
| SHA256 | d2ccbf41552299b24f186f905c846fb20b9f76ed94773677703f75189b838f63 | SHA-256 listed for an XOR-decoded LightSpy plugin sample. |
| SHA256 | e3735950775fbdae7bbcc4a49c09372f605ae021fff8ff32340c794af14a7e47 | SHA-256 listed for a LightSpy KeyChains plugin sample. |
| SHA256 | fbd3f8c8f4b2f4a0c73855e35f96797ef3c5aa6fa11d89081cdacd942e18c933 | SHA-256 listed for a LightSpy ProcessAndApp plugin sample. |
| SHA256 | fc7e77a56772d5ff644da143718ee7dbaf7a1da37cceb446580cd5efb96a9835 | SHA-256 listed for an XOR-decoded LightSpy plugin sample. |
| SHA256 | ff4332365b1628f88bc84bec102b534e5a6e9a32b2fc61dd43c951a338f976d8 | SHA-256 listed for the stage-0 exploit file utils.js. |
MITRE ATT&CK
T1005 · Data from Local SystemLightSpy plugins collected local files, browser history, Keychain contents, and messenger data from affected Macs.T1016 · System Network Configuration DiscoveryLightSpy collected network details including adapter information and Wi-Fi network data and history.T1018 · Remote System DiscoveryThe LanDevices plugin pinged addresses on the victim's local subnet to identify nearby devices.T1027 · Obfuscated Files or InformationThe downloader decrypted embedded content with XOR, while the configuration and payloads were also encrypted and decrypted.T1041 · Exfiltration Over C2 ChannelThe implant sent collected data to its control server, including through WebSocket communication and file-upload commands.T1057 · Process DiscoveryThe Softlist plugin enumerated currently running processes.T1059.004 · Unix ShellThe downloader executed a Bash script that retrieved and prepared additional files.T1105 · Ingress Tool TransferThe Bash script used curl to download payload files, and macircloader retrieved the Core and plugins from the control server.T1113 · Screen CaptureThe ScreenRecorder plugin captured video from the main display.T1123 · Audio CaptureThe soundrecord plugin recorded audio through the device microphone.T1125 · Video CaptureThe cameramodule plugin captured images from available video devices.T1203 · Exploitation for Client ExecutionThe CVE-2018-4233 WebKit exploit triggered in Safari to execute code and deliver the next-stage payload.T1518 · Software DiscoveryThe Softlist plugin enumerated installed applications and their details.T1543.004 · Launch DaemonThe implant used launchctl and update.plist to arrange for the update binary to start at system boot.T1555.001 · KeychainThe Keychain plugin extracted passwords, certificates, and keys from the macOS Keychain.
CVE
People
Malware
Vendors
Products
AndroidIn our research, we proved with a high degree of confidence that both implants for Android and iOS came from the same developer and shared the same network infrastructure, but also that they were just a small part of aGoogle ChromeSafari and Chrome history exfiltration pluginiOSIn our research, we proved with a high degree of confidence that both implants for Android and iOS came from the same developer and shared the same network infrastructure, but also that they were just a small part of amacOSAt the moment of that publication, we knew that the framework was supposed to contain implants for at least four more platforms: Windows, macOS, Linux, and so-called Router.SafariThe starting point threat actor group used the same approach as for iOS implant distribution: triggering WebKit vulnerability inside Safari to perform unprivileged arbitrary code execution.