Osx.Trojan.Leverage, a Breakdown Using Dtrace
Summary: Cisco Talos analyzed Osx.Trojan.Leverage, a Mac trojan first detected in the wild in September 2013 that disguises itself as a JPG image and, when opened, displays a picture while copying its bundle to /Users/Shared/UserEvent.app and deleting its .icns icon file. Using built-in DTrace scripts (execsnoop, newproc.d, opensnoop, soconnect_mac.d), the analyst observed the malware write a LaunchAgents plist with RunAtLoad and KeepAlive set to true, attempt to resolve servicesmsc.sytes.net, and then send system details including OS version, RAM, disk usage and serial number to 0.0.0.0 on TCP port 7777.
Bottom line: The trojan's persistence relied on a single user-level LaunchAgents plist with KeepAlive enabled, so killing the UserEvent process would not stop it, and its failed DNS lookup did not halt communications - it fell back to 0.0.0.0 on port 7777, meaning a dead command-and-control domain is not evidence the implant is dormant.
Read the original at Cisco Talos ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026