LightSpy Malware Actively Targeting MacOS Devices

BlackBerry reported a new iOS LightSpy malware, but Huntress researchers found it to be a macOS variant targeting Intel or Apple Silicon with Rosetta 2-enabled devices. 

This caused media confusion, as Apple’s recent spyware alert likely referred to Pegasus spyware, and there is no evidence of an iOS version in this discovery.

The researchers also identified an Android version (WyrmSpy) but focused on the macOS variant in this paper, providing detection rules for further investigation.

- Advertisement -

Analysis reveals that the LightSpy sample targets MacOS exclusively because the binaries are compiled for the x86_64 architecture, which is incompatible with iPhones’ ARM architecture. The “file” command can be used to confirm this on both platforms. 

Interestingly, the implant structure remains consistent across both versions and employs a dropper to load subsequent dynamic libraries (dylibs) containing the core malicious functionalities.  

LightSpy for macOS shows signs of being a more mature product compared to the iOS version.

macOS LightSpy utilizes a plugin manifest to store C2 information, offering more flexibility and reducing detection. 

While both versions contain developer artifacts, macOS LightSpy suggests a more organized development process.

Two possible developer machines (“mac” and “air”) have been identified, which suggests that the developers behind LightSpy are continuing to refine their malware. 

The LightSpy macOS malware starts with a dropper that checks for a running instance using a PID file and then retrieves its configuration from the binary itself, including server locations and encryption keys. 

Before downloading plugins, the dropper fetches a manifest file containing details and encrypted hashes.

After downloading the core implant, it verifies its integrity against a server-side record. 

The downloaded plugins and the core are XOR-encrypted with a rolling key for decryption. By reversing this encryption method, analysts can examine the functionality of the downloaded plugins. 

Stage 2 of the implant process manages plugin loading and utilization, as in this stage, the implant queries the device for details using the DeviceInformation class and gathers standard device information. 

According to Huntrees, the macOS version of this class excludes phone-specific data like IMEI and IMSI numbers, while tasks like getScreenSizeInches behave differently, and while the iOS version returns device-specific dimensions, the macOS version returns a generic value. 

Despite these variations, communication with the C2 server continues over WebSockets using the open-source SocketRocket library, maintaining functionalities like heartbeats, command exchange, and status updates. 

The analyzed iOS implant downloads 10 additional plugins, each with a unique ID, to perform various malicious tasks, which include AudioRecorder for capturing audio, Browser for potentially interacting with web browsers, and CameraShot for taking pictures. 

There are also plugins with obfuscated names (noted with “aaa”) that likely correspond to functionalities like basic system information gathering, software information gathering, location data retrieval, and potentially targeting specific iOS apps like WeChat, QQ, and Telegram.

Combat Email Threats with Easy-to-Launch Phishing Simulations: Email Security Awareness Training -> Try Free Demo