Jun 26, 2023Ravie LakshmananCryptocurrency / Endpoint Security

An unknown cryptocurrency exchange located in Japan was the target of a new attack earlier this month to deploy an Apple macOS backdoor called JokerSpy.

Elastic Security Labs, which is monitoring the intrusion set under the name REF9134, said the attack led to the installation of Swiftbelt, a Swift-based enumeration tool inspired by an open-source utility called SeatBelt.

JokerSky was first documented by Bitdefender last week, describing it as a sophisticated toolkit designed to breach macOS machines.


Very little is known about the threat actor behind the attacks other than the fact that the attacks leverage a set of programs written in Python and Swift that come with capabilities to gather data and execute arbitrary commands on compromised hosts.

A primary component of the toolkit is a self-signed multi-architecture binary known as xcc that’s engineered to check for FullDiskAccess and ScreenRecording permissions.

The file is signed as XProtectCheck, indicating an attempt to masquerade as XProtect, a built-in antivirus technology within macOS that makes use of signature-based detection rules to remove malware from already infected hosts.

In the incident analyzed by Elastic, the creation of xcc is followed by the threat actor “attempting to bypass TCC permissions by creating their own TCC database and trying to replace the existing one.”

“On June 1, a new Python-based tool was seen executing from the same directory as xcc and was utilized to execute an open-source macOS post-exploitation enumeration tool known as Swiftbelt,” security researchers Colson Wilhoit, Salim Bitam, Seth Goodwin, Andrew Pease, and Ricardo Ungureanu said.

The attack targeted a large Japan-based cryptocurrency service provider focusing on asset exchange for trading Bitcoin, Ethereum, and other common cryptocurrencies. The name of the company was not disclosed.


The xcc binary, for its part, is launched by means of Bash via three different apps that are named IntelliJ IDEA, iTerm (a terminal emulator for macOS), and Visual Studio Code, indicating that backdoored versions of software development software are likely used to gain initial access.

Another notable module installed as part of the attack is sh.py, a Python implant that’s used as a conduit to deliver other post-exploitation tools like Swiftbelt.

“Unlike other enumeration methods, Swiftbelt invokes Swift code to avoid creating command line artifacts,” the researchers said. “Notably, xcc variants are also written using Swift.”

Found this article interesting? Follow us on Twitter and LinkedIn to read more exclusive content we post.

Products You May Like

Articles You May Like

Presidential Candidate Robert F. Kennedy Jr. Visits With Oliver Anthony, Praises His Viral Song: “His Words Arouse Hope”
Vivo T2 Pro Camera Details Revealed Ahead of September 22 India Launch: All Details
Charles Wesley Godwin Shines A Light On Appalachian Life In “Cue Country Roads” Music Video
Russell Brand Denies Allegations of Rape Ahead of Explosive Exposé
Book Fairs Will See An Increase In Censorship Attempts This Year: Book Censorship News, September 15, 2023

Leave a Reply

Your email address will not be published. Required fields are marked *