LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S1016: MacMa

MacMa is a macOS-based backdoor with a large set of functionalities to control and exfiltrate files from a compromised computer. MacMa has been observed in the wild since November 2021.[1] MacMa shares command and control and unique libraries with MgBot and Nightdoor, indicating a relationship with the Daggerfly threat actor.[2]

EnterpriseS1016MalwareObject v2.1Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceHigh

MacMa matters because it represents a macOS backdoor with broad post-compromise capability: file control and exfiltration, discovery, keylogging, screen/audio capture, persistence, and C2 activity. For leaders, the practical issue is whether macOS endpoints are monitored and governed with the same rigor as Windows systems, especially where executives, developers, administrators, journalists, NGO/government users, or telecom-related staff handle sensitive data.

Executive priority

Prioritize MacMa as a validation case for macOS security readiness rather than as a standalone malware name. ATT&CK links it to Daggerfly and to behaviors that affect confidentiality, credential exposure, persistence, and data loss. Executives should ask whether macOS telemetry supports incident reconstruction, whether Keychain and remote service misuse are monitored, whether C2/exfiltration paths are visible, and whether endpoint controls provide audit-ready evidence for regulated or high-sensitivity users.

Technical view

MacMa is documented for macOS and is related to techniques across discovery, collection, credential access, execution, persistence, defense evasion/impairment, command and control, lateral movement, and exfiltration. SOC and IR teams should validate coverage for Launch Agents, Gatekeeper and code-signing anomalies, Keychain access, shell execution, file and directory enumeration, process/user/system/network discovery, local data staging, file deletion, timestomping, tool transfer, non-application-layer C2, and exfiltration over C2. No official ATT&CK detection guidance is provided for this software object, so detections should be built from the related technique behaviors and local macOS baselines.

Likely telemetry

  • macOS endpoint process execution and command-line telemetry
  • Launch Agent plist creation or modification events
  • File system telemetry for staging, deletion, timestamp changes, and unusual access to sensitive user files
  • Keychain access events where available
  • Network telemetry for outbound C2-like connections and non-application-layer protocol use

Detection direction

  • Map detections to the related ATT&CK techniques instead of relying on a MacMa-specific signature, because the object provides no official detection text.
  • Baseline normal macOS Launch Agent creation, shell usage, Keychain access, and developer/admin tooling to reduce false positives.
  • Correlate discovery commands, file staging, screen/audio capture indicators, and outbound network activity into post-compromise behavior chains.
  • Review visibility gaps around macOS privacy permissions, Gatekeeper/quarantine metadata, and code-signing trust decisions.
  • Tune network monitoring for unusual outbound protocols or C2/exfiltration patterns, while recognizing that protocol-level evidence alone may be noisy.

Mitigation priorities

  • Ensure macOS endpoints are included in managed detection, EDR, logging, and incident response playbooks.
  • Harden and monitor Launch Agents, remote services, Keychain access, and application execution trust controls such as Gatekeeper and code signing.
  • Apply least privilege and strong identity controls for users with access to sensitive files or remote services.
  • Restrict unnecessary outbound communications and monitor for suspicious tool transfer and exfiltration paths.
  • Retain sufficient endpoint and network logs to support investigation of file access, staging, deletion, timestomping, and C2 activity.
Additional notes and limits

ATT&CK describes MacMa as a macOS backdoor observed since November 2021, with shared C2 and unique libraries with MgBot and Nightdoor indicating a relationship with Daggerfly. The most useful defensive value is as a macOS coverage assessment across credential access, collection, persistence, evasion, C2, and exfiltration behaviors.

The supplied ATT&CK object does not include official detection guidance, aliases, labels, or object-level tactics. Conclusions about exposure, active exploitation, successful detection, or attribution require local telemetry and incident evidence beyond the supplied fields.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

MacMa

MacMa is a macOS-based backdoor with a large set of functionalities to control and exfiltrate files from a compromised computer. MacMa has been observed in the wild since November 2021.[1] MacMa shares command and control and unique libraries with MgBot and Nightdoor, indicating a relationship with the Daggerfly threat actor.[2]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

27 rows
DomainIDNameRelationship / procedure
EnterpriseT1033System Owner/User Discovery

MacMa can collect the username from the compromised machine.[1]

EnterpriseT1082System Information Discovery

MacMa can collect information about a compromised computer, including: Hardware UUID, Mac serial number, and macOS version.[1]

EnterpriseT1095Non-Application Layer Protocol

MacMa has used a custom JSON-based protocol for its C&C communications.[1]

EnterpriseT1553.002Code SigningSub-technique

MacMa has been delivered using ad hoc Apple Developer code signing certificates.[3]

EnterpriseT1113Screen Capture

MacMa has used Apple’s Core Graphic APIs, such as `CGWindowListCreateImageFromArray`, to capture the user's screen and open windows.[1][4]

EnterpriseT1016System Network Configuration Discovery

MacMa can collect IP addresses from a compromised host.[1]

EnterpriseT1074.001Local Data StagingSub-technique

MacMa has stored collected files locally before exfiltration.[4]

EnterpriseT1543.001Launch AgentSub-technique

MacMa installs a `com.apple.softwareupdate.plist` file in the `/LaunchAgents` folder with the `RunAtLoad` value set to `true`. Upon user login, MacMa is executed from `/var/root/.local/softwareupdate` with root privileges. Some variations also include the `LimitLoadToSessionType` key with the value `Aqua`, ensuring the MacMa only runs when there is a logged in GUI user.[1][4]

EnterpriseT1005Data from Local System

MacMa can collect then exfiltrate files from the compromised system.[1]

EnterpriseT1021Remote Services

MacMa can manage remote screen sessions.[1]

EnterpriseT1106Native API

MacMa has used macOS API functions to perform tasks.[1][4]

EnterpriseT1123Audio Capture

MacMa has the ability to record audio.[4]

EnterpriseT1555.001KeychainSub-technique

MacMa can dump credentials from the macOS keychain.[1]

EnterpriseT1041Exfiltration Over C2 Channel

MacMa exfiltrates data from a supplied path over its C2 channel.[1]

EnterpriseT1057Process Discovery

MacMa can enumerate running processes.[1]

EnterpriseT1070.006TimestompSub-technique

MacMa has the capability to create and modify file timestamps.[1]

EnterpriseT1571Non-Standard Port

MacMa has used TCP port 5633 for C2 Communication.[1]

EnterpriseT1140Deobfuscate/Decode Files or Information

MacMa decrypts a downloaded file using AES-128-EBC with a custom delta.[1]

EnterpriseT1056.001KeyloggingSub-technique

MacMa can use Core Graphics Event Taps to intercept user keystrokes from any text input field and saves them to text files. Text input fields include Spotlight, Finder, Safari, Mail, Messages, and other apps that have text fields for passwords.[4][5]

EnterpriseT1685.006Clear Linux or Mac System LogsSub-technique

MacMa can clear possible malware traces such as application logs.[1]

EnterpriseT1059.004Unix ShellSub-technique

MacMa can execute supplied shell commands and uses bash scripts to perform additional actions.[1][4]

EnterpriseT1680Local Storage Discovery

MacMa can collect information about a compromised computer's disk sizes.[1]

EnterpriseT1553.001Gatekeeper BypassSub-technique

MacMa has removed the `com.apple.quarantineattribute` from the dropped file, `$TMPDIR/airportpaird`.[1]

EnterpriseT1105Ingress Tool Transfer

MacMa has downloaded additional files, including an exploit for used privilege escalation.[1][4]

EnterpriseT1573Encrypted Channel

MacMa has used TLS encryption to initialize a custom protocol for C2 communications.[1]

EnterpriseT1083File and Directory Discovery

MacMa can search for a specific file on the compromised computer and can enumerate files in Desktop, Downloads, and Documents folders.[1]

EnterpriseT1070.004File DeletionSub-technique

MacMa can delete itself from the compromised computer.[1]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G1034: Daggerfly

Daggerfly is a People's Republic of China-linked APT entity active since at least 2012. Daggerfly has targeted individuals, government and NGO entities, and telecommunication companies in Asia and Africa. Daggerfly is associated with exclusive use of MgBot malware and is noted for several potential supply chain infection campaigns.[1][2][3][4]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1033: System Owner/User DiscoveryEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1095: Non-Application Layer ProtocolEnterpriseuses · TechniqueT1553.002: Code SigningEnterpriseuses · TechniqueT1113: Screen CaptureEnterpriseuses · GroupG1034: DaggerflyEnterpriseuses · TechniqueT1016: System Network Configuration DiscoveryEnterpriseuses · TechniqueT1074.001: Local Data StagingEnterpriseuses · TechniqueT1543.001: Launch AgentEnterpriseuses · TechniqueT1005: Data from Local SystemEnterpriseuses · TechniqueT1021: Remote ServicesEnterpriseuses · TechniqueT1106: Native APIEnterpriseuses · TechniqueT1123: Audio CaptureEnterpriseuses · TechniqueT1555.001: KeychainEnterpriseuses · TechniqueT1041: Exfiltration Over C2 ChannelEnterpriseuses · TechniqueT1057: Process DiscoveryEnterpriseuses · TechniqueT1070.006: TimestompEnterpriseuses · TechniqueT1571: Non-Standard PortEnterpriseuses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterpriseuses · TechniqueT1056.001: KeyloggingEnterpriseuses · TechniqueT1685.006: Clear Linux or Mac System LogsEnterpriseuses · TechniqueT1059.004: Unix ShellEnterpriseuses · TechniqueT1680: Local Storage DiscoveryEnterpriseuses · TechniqueT1553.001: Gatekeeper BypassEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
2.1
Created
Modified
Raw hash
93b0a80527ee110d...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.12.1Current bundle93b0a80527ee…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    ESET DazzleSpy Jan 2022

    M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.

    Open source URL
  2. [2]
    Symantec Daggerfly 2024

    Threat Hunter Team. (2024, July 23). Daggerfly: Espionage Group Makes Major Update to Toolset. Retrieved July 25, 2024.

    Open source URL
  3. [3]
    SentinelOne Macma 2021

    Phil Stokes. (2021, November 15). Infect If Needed | A Deeper Dive Into Targeted Backdoor macOS.Macma. Retrieved July 26, 2024.

    Open source URL
  4. [4]
    Objective-See MacMa Nov 2021

    Wardle, P. (2021, November 11). OSX.CDDS (OSX.MacMa). Retrieved June 30, 2022.

    Open source URL
  5. [5]
    SentinelOne MacMa Nov 2021

    Stokes, P. (2021, November 15). Infect If Needed | A Deeper Dive Into Targeted Backdoor macOS.Macma. Retrieved June 30, 2022.

    Open source URL
  6. [6]
    DazzleSpy

    (Citation: ESET DazzleSpy Jan 2022)

  7. [7]
    DazzleSpy

    (Citation: ESET DazzleSpy Jan 2022)

  8. [8]
    DazzleSpy

    (Citation: ESET DazzleSpy Jan 2022)

  9. [9]
    ESET DazzleSpy Jan 2022

    M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.

    Open source URL
  10. [10]
    ESET DazzleSpy Jan 2022

    M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.

    Open source URL
  11. [11]
    OSX.CDDS

    (Citation: Objective-See MacMa Nov 2021)

  12. [12]
    OSX.CDDS

    (Citation: Objective-See MacMa Nov 2021)

  13. [13]
    OSX.CDDS

    (Citation: Objective-See MacMa Nov 2021)

  14. [14]
    Objective-See MacMa Nov 2021

    Wardle, P. (2021, November 11). OSX.CDDS (OSX.MacMa). Retrieved June 30, 2022.

    Open source URL
  15. [15]
    Objective-See MacMa Nov 2021

    Wardle, P. (2021, November 11). OSX.CDDS (OSX.MacMa). Retrieved June 30, 2022.

    Open source URL
  16. [16]
    Symantec Daggerfly 2024

    Threat Hunter Team. (2024, July 23). Daggerfly: Espionage Group Makes Major Update to Toolset. Retrieved July 25, 2024.

    Open source URL
  17. [17]
    Symantec Daggerfly 2024

    Threat Hunter Team. (2024, July 23). Daggerfly: Espionage Group Makes Major Update to Toolset. Retrieved July 25, 2024.

    Open source URL
  18. [18]
    mitre-attackS1016
    Open source URL
  19. [19]
    mitre-attackS1016
    Open source URL
  20. [20]
    mitre-attackS1016
    Open source URL
  21. [21]
    ESET DazzleSpy Jan 2022

    M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.

    Open source URL
  22. [22]
    ESET DazzleSpy Jan 2022

    M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.

    Open source URL
  23. [23]
    ESET DazzleSpy Jan 2022

    M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.

    Open source URL
  24. [24]
    ESET DazzleSpy Jan 2022

    M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.

    Open source URL
  25. [25]
    ESET DazzleSpy Jan 2022

    M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.

    Open source URL
  26. [26]
    ESET DazzleSpy Jan 2022

    M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.

    Open source URL
  27. [27]
    SentinelOne Macma 2021

    Phil Stokes. (2021, November 15). Infect If Needed | A Deeper Dive Into Targeted Backdoor macOS.Macma. Retrieved July 26, 2024.

    Open source URL
  28. [28]
    ESET DazzleSpy Jan 2022

    M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.

    Open source URL
  29. [29]
    ESET DazzleSpy Jan 2022

    M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.

    Open source URL
  30. [30]
    Objective-See MacMa Nov 2021

    Wardle, P. (2021, November 11). OSX.CDDS (OSX.MacMa). Retrieved June 30, 2022.

    Open source URL
  31. [31]
    Objective-See MacMa Nov 2021

    Wardle, P. (2021, November 11). OSX.CDDS (OSX.MacMa). Retrieved June 30, 2022.

    Open source URL
  32. [32]
    Symantec Daggerfly 2024

    Threat Hunter Team. (2024, July 23). Daggerfly: Espionage Group Makes Major Update to Toolset. Retrieved July 25, 2024.

    Open source URL
  33. [33]
    Symantec Daggerfly 2024

    Threat Hunter Team. (2024, July 23). Daggerfly: Espionage Group Makes Major Update to Toolset. Retrieved July 25, 2024.

    Open source URL
  34. [34]
    ESET DazzleSpy Jan 2022

    M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.

    Open source URL
  35. [35]
    ESET DazzleSpy Jan 2022

    M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.

    Open source URL
  36. [36]
    Objective-See MacMa Nov 2021

    Wardle, P. (2021, November 11). OSX.CDDS (OSX.MacMa). Retrieved June 30, 2022.

    Open source URL
  37. [37]
    Objective-See MacMa Nov 2021

    Wardle, P. (2021, November 11). OSX.CDDS (OSX.MacMa). Retrieved June 30, 2022.

    Open source URL
  38. [38]
    ESET DazzleSpy Jan 2022

    M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.

    Open source URL
  39. [39]
    ESET DazzleSpy Jan 2022

    M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.

    Open source URL
  40. [40]
    Objective-See MacMa Nov 2021

    Wardle, P. (2021, November 11). OSX.CDDS (OSX.MacMa). Retrieved June 30, 2022.

    Open source URL
  41. [41]
    Objective-See MacMa Nov 2021

    Wardle, P. (2021, November 11). OSX.CDDS (OSX.MacMa). Retrieved June 30, 2022.

    Open source URL
  42. [42]
    ESET DazzleSpy Jan 2022

    M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.

    Open source URL
  43. [43]
    ESET DazzleSpy Jan 2022

    M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.

    Open source URL
  44. [44]
    ESET DazzleSpy Jan 2022

    M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.

    Open source URL
  45. [45]
    ESET DazzleSpy Jan 2022

    M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.

    Open source URL
  46. [46]
    ESET DazzleSpy Jan 2022

    M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.

    Open source URL
  47. [47]
    ESET DazzleSpy Jan 2022

    M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.

    Open source URL
  48. [48]
    Objective-See MacMa Nov 2021

    Wardle, P. (2021, November 11). OSX.CDDS (OSX.MacMa). Retrieved June 30, 2022.

    Open source URL
  49. [49]
    Objective-See MacMa Nov 2021

    Wardle, P. (2021, November 11). OSX.CDDS (OSX.MacMa). Retrieved June 30, 2022.

    Open source URL
  50. [50]
    Objective-See MacMa Nov 2021

    Wardle, P. (2021, November 11). OSX.CDDS (OSX.MacMa). Retrieved June 30, 2022.

    Open source URL
  51. [51]
    Objective-See MacMa Nov 2021

    Wardle, P. (2021, November 11). OSX.CDDS (OSX.MacMa). Retrieved June 30, 2022.

    Open source URL
  52. [52]
    ESET DazzleSpy Jan 2022

    M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.

    Open source URL
  53. [53]
    ESET DazzleSpy Jan 2022

    M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.

    Open source URL
  54. [54]
    ESET DazzleSpy Jan 2022

    M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.

    Open source URL
  55. [55]
    ESET DazzleSpy Jan 2022

    M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.

    Open source URL
  56. [56]
    ESET DazzleSpy Jan 2022

    M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.

    Open source URL
  57. [57]
    ESET DazzleSpy Jan 2022

    M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.

    Open source URL
  58. [58]
    ESET DazzleSpy Jan 2022

    M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.

    Open source URL
  59. [59]
    ESET DazzleSpy Jan 2022

    M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.

    Open source URL
  60. [60]
    ESET DazzleSpy Jan 2022

    M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.

    Open source URL
  61. [61]
    ESET DazzleSpy Jan 2022

    M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.

    Open source URL
  62. [62]
    ESET DazzleSpy Jan 2022

    M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.

    Open source URL
  63. [63]
    ESET DazzleSpy Jan 2022

    M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.

    Open source URL
  64. [64]
    Objective-See MacMa Nov 2021

    Wardle, P. (2021, November 11). OSX.CDDS (OSX.MacMa). Retrieved June 30, 2022.

    Open source URL
  65. [65]
    Objective-See MacMa Nov 2021

    Wardle, P. (2021, November 11). OSX.CDDS (OSX.MacMa). Retrieved June 30, 2022.

    Open source URL
  66. [66]
    SentinelOne MacMa Nov 2021

    Stokes, P. (2021, November 15). Infect If Needed | A Deeper Dive Into Targeted Backdoor macOS.Macma. Retrieved June 30, 2022.

    Open source URL
  67. [67]
    ESET DazzleSpy Jan 2022

    M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.

    Open source URL
  68. [68]
    ESET DazzleSpy Jan 2022

    M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.

    Open source URL
  69. [69]
    ESET DazzleSpy Jan 2022

    M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.

    Open source URL
  70. [70]
    ESET DazzleSpy Jan 2022

    M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.

    Open source URL
  71. [71]
    Objective-See MacMa Nov 2021

    Wardle, P. (2021, November 11). OSX.CDDS (OSX.MacMa). Retrieved June 30, 2022.

    Open source URL
  72. [72]
    Objective-See MacMa Nov 2021

    Wardle, P. (2021, November 11). OSX.CDDS (OSX.MacMa). Retrieved June 30, 2022.

    Open source URL
  73. [73]
    ESET DazzleSpy Jan 2022

    M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.

    Open source URL
  74. [74]
    ESET DazzleSpy Jan 2022

    M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.

    Open source URL
  75. [75]
    ESET DazzleSpy Jan 2022

    M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.

    Open source URL
  76. [76]
    ESET DazzleSpy Jan 2022

    M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.

    Open source URL
  77. [77]
    Objective-See MacMa Nov 2021

    Wardle, P. (2021, November 11). OSX.CDDS (OSX.MacMa). Retrieved June 30, 2022.

    Open source URL
  78. [78]
    ESET DazzleSpy Jan 2022

    M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.

    Open source URL
  79. [79]
    ESET DazzleSpy Jan 2022

    M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.

    Open source URL
  80. [80]
    ESET DazzleSpy Jan 2022

    M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use