DISSECTING THE MACOS 'APPLEPROCESSHUB' STEALER: TECHNICAL ANALYSIS OF A MULTI-STAGE ATTACK

Summary from the TLDR InfoSec newsletter

This analysis looks at the macOS "AppleProcessHub" stealer, which was discovered on May 15. It appears as a dynamic library file (libsystd.dylib) but is actually an executable written in Objective-C. The malware employs AES-128 encryption to decrypt hardcoded strings that form the command and control server URL (appleprocesshub[.]com), then downloads and runs a bash script to steal sensitive data like keychain passwords, SSH keys, shell history, and cryptocurrency wallets. The stolen data is compressed and sent to the attacker's server. The malware can run any script on the C2 infrastructure, making it a versatile tool for data exfiltration targeted at macOS users.