S0276: Keydnap
This piece of malware steals the content of the user's keychain while maintaining a permanent backdoor [1].
Security context for executives and security teams
Keydnap is a macOS malware entry focused on credential theft from the user keychain while maintaining a persistent backdoor. Its business significance is that a compromised Mac can become both an identity breach point and a long-lived access foothold, especially where keychains contain user, Wi-Fi, mail, browser, certificate, or other stored secrets.
Executive priority
Prioritize this behavior where macOS systems are used by privileged users, administrators, developers, executives, or staff with access to sensitive SaaS, cloud, VPN, or certificate-based workflows. The ATT&CK relationships point to practical risk areas leaders should ask about: macOS persistence visibility, keychain and securityd protection, user credential prompt abuse, Python/script execution governance, and whether web-based command-and-control traffic can be investigated with enough context for incident response and audit evidence.
Technical view
For SOC, detection engineering, and IR teams, validate macOS coverage around the related techniques: Launch Agent persistence, suspicious setuid/setgid abuse, Python execution, GUI credential prompt mimicry, Securityd Memory access, resource fork hiding, filename-extension deception using a trailing space, and outbound web-protocol command-and-control that may traverse proxies. Because the ATT&CK object provides no official detection text, coverage should be proven through local telemetry tests, baselines, and incident playbooks rather than assumed from control presence.
Likely telemetry
- macOS endpoint process execution, including Python interpreter and script activity
- Launch Agent plist creation or modification in /System/Library/LaunchAgents, /Library/LaunchAgents, and ~/Library/LaunchAgents
- File metadata and extended attributes that can reveal resource forks
- Filesystem events involving unusual filenames, including trailing-space extension deception patterns
- Privilege and file-permission changes involving setuid or setgid bits
Detection direction
- Build detections around combinations of behaviors rather than one indicator: Launch Agent persistence plus unusual Python execution, credential prompting, keychain/securityd access, or suspicious outbound web traffic is higher value than any single event.
- Tune for macOS-specific blind spots, including per-user LaunchAgents, extended attributes/resource forks, and filename presentation tricks that may not be obvious in standard file listings.
- Baseline legitimate administrative use of Python, Launch Agents, and setuid/setgid binaries to reduce false positives while preserving visibility into new, user-writable, or unusual locations.
- Ensure network monitoring can investigate web-protocol command-and-control without relying only on source attribution, since the related Multi-hop Proxy technique means the visible remote endpoint may not represent the original operator infrastructure.
- Because MITRE supplies no official detection guidance for this object, require validation through controlled defensive testing, retrospective hunting, and IR evidence collection on representative macOS systems.
Mitigation priorities
- Harden macOS identity exposure first: minimize stored secrets where feasible, protect privileged accounts, and ensure rapid credential rotation procedures exist for suspected keychain theft.
- Restrict and monitor persistence paths, especially user and system LaunchAgents, with change control for approved management tools.
- Review privilege boundaries and file permissions to reduce unnecessary setuid/setgid exposure on macOS systems.
- Govern scripting execution, including Python, through approved administrative workflows and endpoint monitoring rather than unmanaged local execution.
- Improve user-awareness and helpdesk workflows for unexpected credential prompts, especially prompts appearing after opening downloaded or unusual files.
Additional notes and limits
The available ATT&CK object is sparse: Keydnap is described as macOS malware that steals user keychain content and maintains a permanent backdoor, with no official detection section and no tactics listed directly on the malware object. The strongest defensive context comes from its ATT&CK relationships to techniques covering stealth, execution, command-and-control, persistence, privilege escalation, collection, and credential access.
This take uses only the supplied ATT&CK fields, references, and relationships. It does not assert current activity, attribution, prevalence, specific indicators, customer exposure, or guaranteed detection. Local macOS configuration, endpoint tooling, identity architecture, and logging retention determine actual risk and coverage.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Keydnap
This piece of malware steals the content of the user's keychain while maintaining a permanent backdoor [1].
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Techniques used
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1090.003 | Multi-hop ProxySub-technique | |
| Enterprise | T1071.001 | Web ProtocolsSub-technique | |
| Enterprise | T1555.002 | Securityd MemorySub-technique | |
| Enterprise | T1564.009 | Resource ForkingSub-technique | |
| Enterprise | T1548.001 | Setuid and SetgidSub-technique | |
| Enterprise | T1056.002 | GUI Input CaptureSub-technique | |
| Enterprise | T1036.006 | Space after FilenameSub-technique | |
| Enterprise | T1059.006 | PythonSub-technique | |
| Enterprise | T1543.001 | Launch AgentSub-technique |
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.2 | Current bundle | 950e4f52e249… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]OSX Keydnap malware
Marc-Etienne M.Leveille. (2016, July 6). New OSX/Keydnap malware is hungry for credentials. Retrieved July 3, 2017.
Open source URL - [2]synack 2016 review
Patrick Wardle. (2017, January 1). Mac Malware of 2016. Retrieved September 21, 2018.
Open source URL - [3]Keydnap
(Citation: synack 2016 review)
- [4]Keydnap
(Citation: synack 2016 review)
- [5]Keydnap
(Citation: synack 2016 review)
- [6]OSX Keydnap malware
Marc-Etienne M.Leveille. (2016, July 6). New OSX/Keydnap malware is hungry for credentials. Retrieved July 3, 2017.
Open source URL - [7]OSX Keydnap malware
Marc-Etienne M.Leveille. (2016, July 6). New OSX/Keydnap malware is hungry for credentials. Retrieved July 3, 2017.
Open source URL - [8]OSX/Keydnap
(Citation: OSX Keydnap malware)
- [9]OSX/Keydnap
(Citation: OSX Keydnap malware)
- [10]OSX/Keydnap
(Citation: OSX Keydnap malware)
- [11]mitre-attackS0276Open source URL
- [12]mitre-attackS0276Open source URL
- [13]mitre-attackS0276Open source URL
- [14]synack 2016 review
Patrick Wardle. (2017, January 1). Mac Malware of 2016. Retrieved September 21, 2018.
Open source URL - [15]synack 2016 review
Patrick Wardle. (2017, January 1). Mac Malware of 2016. Retrieved September 21, 2018.
Open source URL - [16]synack 2016 review
Patrick Wardle. (2017, January 1). Mac Malware of 2016. Retrieved September 21, 2018.
Open source URL - [17]synack 2016 review
Patrick Wardle. (2017, January 1). Mac Malware of 2016. Retrieved September 21, 2018.
Open source URL - [18]synack 2016 review
Patrick Wardle. (2017, January 1). Mac Malware of 2016. Retrieved September 21, 2018.
Open source URL - [19]synack 2016 review
Patrick Wardle. (2017, January 1). Mac Malware of 2016. Retrieved September 21, 2018.
Open source URL - [20]synack 2016 review
Patrick Wardle. (2017, January 1). Mac Malware of 2016. Retrieved September 21, 2018.
Open source URL - [21]synack 2016 review
Patrick Wardle. (2017, January 1). Mac Malware of 2016. Retrieved September 21, 2018.
Open source URL - [22]OSX Keydnap malware
Marc-Etienne M.Leveille. (2016, July 6). New OSX/Keydnap malware is hungry for credentials. Retrieved July 3, 2017.
Open source URL - [23]OSX Keydnap malware
Marc-Etienne M.Leveille. (2016, July 6). New OSX/Keydnap malware is hungry for credentials. Retrieved July 3, 2017.
Open source URL - [24]OSX Keydnap malware
Marc-Etienne M.Leveille. (2016, July 6). New OSX/Keydnap malware is hungry for credentials. Retrieved July 3, 2017.
Open source URL - [25]OSX Keydnap malware
Marc-Etienne M.Leveille. (2016, July 6). New OSX/Keydnap malware is hungry for credentials. Retrieved July 3, 2017.
Open source URL - [26]synack 2016 review
Patrick Wardle. (2017, January 1). Mac Malware of 2016. Retrieved September 21, 2018.
Open source URL - [27]synack 2016 review
Patrick Wardle. (2017, January 1). Mac Malware of 2016. Retrieved September 21, 2018.
Open source URL - [28]synack 2016 review
Patrick Wardle. (2017, January 1). Mac Malware of 2016. Retrieved September 21, 2018.
Open source URL - [29]synack 2016 review
Patrick Wardle. (2017, January 1). Mac Malware of 2016. Retrieved September 21, 2018.
Open source URL - [30]synack 2016 review
Patrick Wardle. (2017, January 1). Mac Malware of 2016. Retrieved September 21, 2018.
Open source URL - [31]synack 2016 review
Patrick Wardle. (2017, January 1). Mac Malware of 2016. Retrieved September 21, 2018.
Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.