LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0482: Bundlore

Bundlore is adware written for macOS that has been in use since at least 2015. Though categorized as adware, Bundlore has many features associated with more traditional backdoors.[1]

EnterpriseS0482MalwareObject v1.1Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

Bundlore matters because it is macOS adware that MITRE notes has features associated with more traditional backdoors. For leaders, the risk is not just nuisance adware: the ATT&CK relationships show behaviors spanning user-driven execution, scripting, persistence, discovery, web-based command-and-control, file transfer, possible exfiltration over alternate protocols, and stealth. That makes it a useful test case for whether macOS endpoints are covered with the same seriousness as Windows systems.

Executive priority

Prioritize Bundlore as a macOS control-validation scenario. Ask whether the organization can prove visibility into macOS downloads, user-opened files, scripting interpreters, Launch Agents/Daemons, browser extensions, SSH authorized keys, unusual outbound web traffic, and security-tool tampering. This is relevant to business continuity and audit readiness because unmanaged macOS fleets, weak browser governance, and missing endpoint telemetry can turn “adware” into a broader incident-response and data-risk problem.

Technical view

ATT&CK provides no official detection text for Bundlore, so SOC and detection teams should build coverage from the linked techniques. Validate macOS telemetry for T1204.002 user execution, T1189 drive-by compromise context, T1059.002 AppleScript, T1059.004 Unix Shell, T1059.006 Python, T1059.007 JavaScript, T1543.001 Launch Agent and T1543.004 Launch Daemon persistence, T1176.001 browser extensions, T1098.004 SSH authorized_keys modification, T1057/T1082/T1518 discovery, T1071.001 web protocols, T1105 tool transfer, T1048 alternate-protocol exfiltration, and stealth/defense-impairment behaviors including T1027, T1140, T1036.005, T1222.002, T1564, and the supplied T1685 relationship. Because the object platform is macOS, prioritize macOS-specific validation and treat technique platform mismatches as items requiring local confirmation.

Likely telemetry

  • macOS endpoint process creation and command-line telemetry, including osascript, shell, Python, and JavaScript runtime activity
  • File creation/modification events for downloaded files, hidden files, permission changes, and obfuscated or decoded payload artifacts
  • Launch Agent and Launch Daemon plist creation or modification in standard macOS launch locations
  • Browser extension inventory and extension installation/change events
  • SSH authorized_keys file creation or modification under user home directories

Detection direction

  • Do not rely on an adware label alone; tune for the combination of installer/user execution, scripting, persistence, discovery, and outbound communications.
  • Baseline legitimate macOS administration activity so AppleScript, shell, Python, JavaScript, Launch Agents/Daemons, and permission changes do not generate unmanageable false positives.
  • Correlate persistence artifacts with recent downloads, browser activity, interpreter execution, and new external network connections.
  • Review browser-extension monitoring; this is a common blind spot on macOS fleets and is directly represented by the ATT&CK relationship to T1176.001.
  • Validate egress visibility beyond standard web proxy logs, because relationships include web protocols, ingress tool transfer, and exfiltration over alternative protocol.

Mitigation priorities

  • Enforce managed macOS software installation controls and reduce unmanaged user execution of downloaded files where business-appropriate.
  • Govern browser extensions through policy, inventory, and approval workflows.
  • Limit unnecessary local administrator rights and educate users on suspicious credential or privilege prompts.
  • Monitor and control Launch Agents, Launch Daemons, SSH authorized_keys, hidden files, and permission changes on macOS endpoints.
  • Maintain endpoint security and logging-agent tamper resistance and alerting for health degradation.
Additional notes and limits

The strongest defensive value is using Bundlore as a macOS coverage assessment across execution, persistence, browser, identity-adjacent SSH key, discovery, C2, transfer, exfiltration, and stealth behaviors. The object has no aliases, no official detection guidance, and no object-level tactics specified, so relationship-driven ATT&CK techniques are the basis for this take.

This summary uses only the supplied ATT&CK STIX fields, external reference, and relationships. It does not establish current activity, specific victim exposure, attribution, exploit chain details, or guaranteed detection logic. Local macOS fleet composition, telemetry quality, browser policy, network architecture, and endpoint control configuration are required to determine actual risk and coverage.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Bundlore

Bundlore is adware written for macOS that has been in use since at least 2015. Though categorized as adware, Bundlore has many features associated with more traditional backdoors.[1]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

23 rows
DomainIDNameRelationship / procedure
EnterpriseT1048Exfiltration Over Alternative Protocol

Bundlore uses the curl -s -L -o command to exfiltrate archived data to a URL.[2]

EnterpriseT1036.005Match Legitimate Resource Name or LocationSub-technique

Bundlore has disguised a malicious .app file as a Flash Player update.[1]

EnterpriseT1082System Information Discovery

Bundlore will enumerate the macOS version to determine which follow-on behaviors to execute using /usr/bin/sw_vers -productVersion.[1][2]

EnterpriseT1057Process Discovery

Bundlore has used the ps command to list processes.[1]

EnterpriseT1059.004Unix ShellSub-technique

Bundlore has leveraged /bin/sh and /bin/bash to execute commands on the victim machine.[1]

EnterpriseT1564Hide Artifacts

Bundlore uses the mktemp utility to make unique file and directory names for payloads, such as TMP_DIR=`mktemp -d -t x.[2]

EnterpriseT1189Drive-by Compromise

Bundlore has been spread through malicious advertisements on websites.[1]

EnterpriseT1098.004SSH Authorized KeysSub-technique

Bundlore creates a new key pair with ssh-keygen and drops the newly created user key in authorized_keys to enable remote login.[1]

EnterpriseT1059.006PythonSub-technique

Bundlore has used Python scripts to execute payloads.[1]

EnterpriseT1140Deobfuscate/Decode Files or Information

Bundlore has used openssl to decrypt AES encrypted payload data. Bundlore has also used base64 and RC4 with a hardcoded key to deobfuscate data.[1]

EnterpriseT1105Ingress Tool Transfer

Bundlore can download and execute new versions of itself.[1]

EnterpriseT1543.001Launch AgentSub-technique

Bundlore can persist via a LaunchAgent.[1]

EnterpriseT1685Disable or Modify Tools

Bundlore can change browser security settings to enable extensions to be installed. Bundlore uses the pkill cfprefsd command to prevent users from inspecting processes.[1][2]

EnterpriseT1027Obfuscated Files or Information

Bundlore has obfuscated data with base64, AES, RC4, and bz2.[1]

EnterpriseT1518Software Discovery

Bundlore has the ability to enumerate what browser is being used as well as version information for Safari.[1]

EnterpriseT1056.002GUI Input CaptureSub-technique

Bundlore prompts the user for their credentials.[1]

EnterpriseT1204.002Malicious FileSub-technique

Bundlore has attempted to get users to execute a malicious .app file that looks like a Flash Player update.[1]

EnterpriseT1543.004Launch DaemonSub-technique

Bundlore can persist via a LaunchDaemon.[1]

EnterpriseT1176.001Browser ExtensionsSub-technique

Bundlore can install malicious browser extensions that are used to hijack user searches.[1]

EnterpriseT1059.002AppleScriptSub-technique

Bundlore can use AppleScript to inject malicious JavaScript into a browser.[1]

EnterpriseT1059.007JavaScriptSub-technique

Bundlore can execute JavaScript by injecting it into the victim's browser.[1]

EnterpriseT1222.002Linux and Mac PermissionsSub-technique

Bundlore changes the permissions of a payload using the command chmod -R 755.[2]

EnterpriseT1071.001Web ProtocolsSub-technique

Bundlore uses HTTP requests for C2.[1]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1048: Exfiltration Over Alternative ProtocolEnterpriseuses · TechniqueT1036.005: Match Legitimate Resource Name or LocationEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1057: Process DiscoveryEnterpriseuses · TechniqueT1059.004: Unix ShellEnterpriseuses · TechniqueT1564: Hide ArtifactsEnterpriseuses · TechniqueT1189: Drive-by CompromiseEnterpriseuses · TechniqueT1098.004: SSH Authorized KeysEnterpriseuses · TechniqueT1059.006: PythonEnterpriseuses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1543.001: Launch AgentEnterpriseuses · TechniqueT1685: Disable or Modify ToolsEnterpriseuses · TechniqueT1027: Obfuscated Files or InformationEnterpriseuses · TechniqueT1518: Software DiscoveryEnterpriseuses · TechniqueT1056.002: GUI Input CaptureEnterpriseuses · TechniqueT1204.002: Malicious FileEnterpriseuses · TechniqueT1543.004: Launch DaemonEnterpriseuses · TechniqueT1176.001: Browser ExtensionsEnterpriseuses · TechniqueT1059.002: AppleScriptEnterpriseuses · TechniqueT1059.007: JavaScriptEnterpriseuses · TechniqueT1222.002: Linux and Mac PermissionsEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.1
Created
Modified
Raw hash
9ef6855cb354783b...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.1Current bundle9ef6855cb354…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    MacKeeper Bundlore Apr 2019

    Sushko, O. (2019, April 17). macOS Bundlore: Mac Virus Bypassing macOS Security Features. Retrieved June 30, 2020.

    Open source URL
  2. [2]
    20 macOS Common Tools and Techniques

    Phil Stokes. (2021, February 16). 20 Common Tools & Techniques Used by macOS Threat Actors & Malware. Retrieved August 23, 2021.

    Open source URL
  3. [3]
    MacKeeper Bundlore Apr 2019

    Sushko, O. (2019, April 17). macOS Bundlore: Mac Virus Bypassing macOS Security Features. Retrieved June 30, 2020.

    Open source URL
  4. [4]
    MacKeeper Bundlore Apr 2019

    Sushko, O. (2019, April 17). macOS Bundlore: Mac Virus Bypassing macOS Security Features. Retrieved June 30, 2020.

    Open source URL
  5. [5]
    OSX.Bundlore

    (Citation: MacKeeper Bundlore Apr 2019)

  6. [6]
    OSX.Bundlore

    (Citation: MacKeeper Bundlore Apr 2019)

  7. [7]
    OSX.Bundlore

    (Citation: MacKeeper Bundlore Apr 2019)

  8. [8]
    mitre-attackS0482
    Open source URL
  9. [9]
    mitre-attackS0482
    Open source URL
  10. [10]
    mitre-attackS0482
    Open source URL
  11. [11]
    20 macOS Common Tools and Techniques

    Phil Stokes. (2021, February 16). 20 Common Tools & Techniques Used by macOS Threat Actors & Malware. Retrieved August 23, 2021.

    Open source URL
  12. [12]
    MacKeeper Bundlore Apr 2019

    Sushko, O. (2019, April 17). macOS Bundlore: Mac Virus Bypassing macOS Security Features. Retrieved June 30, 2020.

    Open source URL
  13. [13]
    MacKeeper Bundlore Apr 2019

    Sushko, O. (2019, April 17). macOS Bundlore: Mac Virus Bypassing macOS Security Features. Retrieved June 30, 2020.

    Open source URL
  14. [14]
    20 macOS Common Tools and Techniques

    Phil Stokes. (2021, February 16). 20 Common Tools & Techniques Used by macOS Threat Actors & Malware. Retrieved August 23, 2021.

    Open source URL
  15. [15]
    20 macOS Common Tools and Techniques

    Phil Stokes. (2021, February 16). 20 Common Tools & Techniques Used by macOS Threat Actors & Malware. Retrieved August 23, 2021.

    Open source URL
  16. [16]
    MacKeeper Bundlore Apr 2019

    Sushko, O. (2019, April 17). macOS Bundlore: Mac Virus Bypassing macOS Security Features. Retrieved June 30, 2020.

    Open source URL
  17. [17]
    MacKeeper Bundlore Apr 2019

    Sushko, O. (2019, April 17). macOS Bundlore: Mac Virus Bypassing macOS Security Features. Retrieved June 30, 2020.

    Open source URL
  18. [18]
    MacKeeper Bundlore Apr 2019

    Sushko, O. (2019, April 17). macOS Bundlore: Mac Virus Bypassing macOS Security Features. Retrieved June 30, 2020.

    Open source URL
  19. [19]
    MacKeeper Bundlore Apr 2019

    Sushko, O. (2019, April 17). macOS Bundlore: Mac Virus Bypassing macOS Security Features. Retrieved June 30, 2020.

    Open source URL
  20. [20]
    MacKeeper Bundlore Apr 2019

    Sushko, O. (2019, April 17). macOS Bundlore: Mac Virus Bypassing macOS Security Features. Retrieved June 30, 2020.

    Open source URL
  21. [21]
    MacKeeper Bundlore Apr 2019

    Sushko, O. (2019, April 17). macOS Bundlore: Mac Virus Bypassing macOS Security Features. Retrieved June 30, 2020.

    Open source URL
  22. [22]
    20 macOS Common Tools and Techniques

    Phil Stokes. (2021, February 16). 20 Common Tools & Techniques Used by macOS Threat Actors & Malware. Retrieved August 23, 2021.

    Open source URL
  23. [23]
    20 macOS Common Tools and Techniques

    Phil Stokes. (2021, February 16). 20 Common Tools & Techniques Used by macOS Threat Actors & Malware. Retrieved August 23, 2021.

    Open source URL
  24. [24]
    MacKeeper Bundlore Apr 2019

    Sushko, O. (2019, April 17). macOS Bundlore: Mac Virus Bypassing macOS Security Features. Retrieved June 30, 2020.

    Open source URL
  25. [25]
    MacKeeper Bundlore Apr 2019

    Sushko, O. (2019, April 17). macOS Bundlore: Mac Virus Bypassing macOS Security Features. Retrieved June 30, 2020.

    Open source URL
  26. [26]
    MacKeeper Bundlore Apr 2019

    Sushko, O. (2019, April 17). macOS Bundlore: Mac Virus Bypassing macOS Security Features. Retrieved June 30, 2020.

    Open source URL
  27. [27]
    MacKeeper Bundlore Apr 2019

    Sushko, O. (2019, April 17). macOS Bundlore: Mac Virus Bypassing macOS Security Features. Retrieved June 30, 2020.

    Open source URL
  28. [28]
    MacKeeper Bundlore Apr 2019

    Sushko, O. (2019, April 17). macOS Bundlore: Mac Virus Bypassing macOS Security Features. Retrieved June 30, 2020.

    Open source URL
  29. [29]
    MacKeeper Bundlore Apr 2019

    Sushko, O. (2019, April 17). macOS Bundlore: Mac Virus Bypassing macOS Security Features. Retrieved June 30, 2020.

    Open source URL
  30. [30]
    MacKeeper Bundlore Apr 2019

    Sushko, O. (2019, April 17). macOS Bundlore: Mac Virus Bypassing macOS Security Features. Retrieved June 30, 2020.

    Open source URL
  31. [31]
    MacKeeper Bundlore Apr 2019

    Sushko, O. (2019, April 17). macOS Bundlore: Mac Virus Bypassing macOS Security Features. Retrieved June 30, 2020.

    Open source URL
  32. [32]
    MacKeeper Bundlore Apr 2019

    Sushko, O. (2019, April 17). macOS Bundlore: Mac Virus Bypassing macOS Security Features. Retrieved June 30, 2020.

    Open source URL
  33. [33]
    MacKeeper Bundlore Apr 2019

    Sushko, O. (2019, April 17). macOS Bundlore: Mac Virus Bypassing macOS Security Features. Retrieved June 30, 2020.

    Open source URL
  34. [34]
    MacKeeper Bundlore Apr 2019

    Sushko, O. (2019, April 17). macOS Bundlore: Mac Virus Bypassing macOS Security Features. Retrieved June 30, 2020.

    Open source URL
  35. [35]
    MacKeeper Bundlore Apr 2019

    Sushko, O. (2019, April 17). macOS Bundlore: Mac Virus Bypassing macOS Security Features. Retrieved June 30, 2020.

    Open source URL
  36. [36]
    20 macOS Common Tools and Techniques

    Phil Stokes. (2021, February 16). 20 Common Tools & Techniques Used by macOS Threat Actors & Malware. Retrieved August 23, 2021.

    Open source URL
  37. [37]
    20 macOS Common Tools and Techniques

    Phil Stokes. (2021, February 16). 20 Common Tools & Techniques Used by macOS Threat Actors & Malware. Retrieved August 23, 2021.

    Open source URL
  38. [38]
    MacKeeper Bundlore Apr 2019

    Sushko, O. (2019, April 17). macOS Bundlore: Mac Virus Bypassing macOS Security Features. Retrieved June 30, 2020.

    Open source URL
  39. [39]
    MacKeeper Bundlore Apr 2019

    Sushko, O. (2019, April 17). macOS Bundlore: Mac Virus Bypassing macOS Security Features. Retrieved June 30, 2020.

    Open source URL
  40. [40]
    MacKeeper Bundlore Apr 2019

    Sushko, O. (2019, April 17). macOS Bundlore: Mac Virus Bypassing macOS Security Features. Retrieved June 30, 2020.

    Open source URL
  41. [41]
    MacKeeper Bundlore Apr 2019

    Sushko, O. (2019, April 17). macOS Bundlore: Mac Virus Bypassing macOS Security Features. Retrieved June 30, 2020.

    Open source URL
  42. [42]
    MacKeeper Bundlore Apr 2019

    Sushko, O. (2019, April 17). macOS Bundlore: Mac Virus Bypassing macOS Security Features. Retrieved June 30, 2020.

    Open source URL
  43. [43]
    MacKeeper Bundlore Apr 2019

    Sushko, O. (2019, April 17). macOS Bundlore: Mac Virus Bypassing macOS Security Features. Retrieved June 30, 2020.

    Open source URL
  44. [44]
    MacKeeper Bundlore Apr 2019

    Sushko, O. (2019, April 17). macOS Bundlore: Mac Virus Bypassing macOS Security Features. Retrieved June 30, 2020.

    Open source URL
  45. [45]
    MacKeeper Bundlore Apr 2019

    Sushko, O. (2019, April 17). macOS Bundlore: Mac Virus Bypassing macOS Security Features. Retrieved June 30, 2020.

    Open source URL
  46. [46]
    MacKeeper Bundlore Apr 2019

    Sushko, O. (2019, April 17). macOS Bundlore: Mac Virus Bypassing macOS Security Features. Retrieved June 30, 2020.

    Open source URL
  47. [47]
    MacKeeper Bundlore Apr 2019

    Sushko, O. (2019, April 17). macOS Bundlore: Mac Virus Bypassing macOS Security Features. Retrieved June 30, 2020.

    Open source URL
  48. [48]
    MacKeeper Bundlore Apr 2019

    Sushko, O. (2019, April 17). macOS Bundlore: Mac Virus Bypassing macOS Security Features. Retrieved June 30, 2020.

    Open source URL
  49. [49]
    MacKeeper Bundlore Apr 2019

    Sushko, O. (2019, April 17). macOS Bundlore: Mac Virus Bypassing macOS Security Features. Retrieved June 30, 2020.

    Open source URL
  50. [50]
    MacKeeper Bundlore Apr 2019

    Sushko, O. (2019, April 17). macOS Bundlore: Mac Virus Bypassing macOS Security Features. Retrieved June 30, 2020.

    Open source URL
  51. [51]
    MacKeeper Bundlore Apr 2019

    Sushko, O. (2019, April 17). macOS Bundlore: Mac Virus Bypassing macOS Security Features. Retrieved June 30, 2020.

    Open source URL
  52. [52]
    MacKeeper Bundlore Apr 2019

    Sushko, O. (2019, April 17). macOS Bundlore: Mac Virus Bypassing macOS Security Features. Retrieved June 30, 2020.

    Open source URL
  53. [53]
    MacKeeper Bundlore Apr 2019

    Sushko, O. (2019, April 17). macOS Bundlore: Mac Virus Bypassing macOS Security Features. Retrieved June 30, 2020.

    Open source URL
  54. [54]
    MacKeeper Bundlore Apr 2019

    Sushko, O. (2019, April 17). macOS Bundlore: Mac Virus Bypassing macOS Security Features. Retrieved June 30, 2020.

    Open source URL
  55. [55]
    MacKeeper Bundlore Apr 2019

    Sushko, O. (2019, April 17). macOS Bundlore: Mac Virus Bypassing macOS Security Features. Retrieved June 30, 2020.

    Open source URL
  56. [56]
    20 macOS Common Tools and Techniques

    Phil Stokes. (2021, February 16). 20 Common Tools & Techniques Used by macOS Threat Actors & Malware. Retrieved August 23, 2021.

    Open source URL
  57. [57]
    MacKeeper Bundlore Apr 2019

    Sushko, O. (2019, April 17). macOS Bundlore: Mac Virus Bypassing macOS Security Features. Retrieved June 30, 2020.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use