⚠️ Overview

OSAMiner is a macOS cryptocurrency miner (coinminer) first publicly documented in August 2018 by security researchers at Malwarebytes and later analyzed by Trend Micro. It is attributed to an unknown threat actor group and primarily targets Mac users, leveraging the operating system’s scripting capabilities to execute Monero (XMR) mining payloads without the victim’s consent. Unlike ransomware or banking trojans, OSAMiner functions strictly as a stealthy resource drainer, generating profits for its operators at the expense of infected systems.

🔧 Technical Capabilities

OSAMiner propagates mainly through malicious DMG files hosted on compromised websites or delivered via phishing emails, often disguised as pirated software (e.g., Adobe Photoshop or Microsoft Office). Its primary attack vector is the osascript command-line tool, which it uses to execute AppleScript scripts that download and run a Monero mining binary from remote servers. The malware establishes command-and-control (C2) communication over HTTP to fetch mining configurations and payload updates; Trend Micro reports that the C2 infrastructure frequently uses dynamic DNS domains. For persistence, OSAMiner installs a LaunchAgent plist file in ~/Library/LaunchAgents/ that re-injects the malicious AppleScript on user login. Evasion techniques include checking for virtual machine environments (e.g., VMware or VirtualBox) to avoid analysis, and it deliberately avoids running on systems with active security monitoring processes such as Little Snitch or Objective-See tools.

📜 History & Notable Incidents

OSAMiner first surfaced in mid-2018 when Malwarebytes’ Mac malware researcher Thomas Reed documented a campaign distributing a fake Adobe Flash Player installer that delivered the miner. A significant campaign occurred in October 2018, described by Trend Micro as affecting thousands of macOS devices globally, with victims in the United States, Germany, and Japan. No specific CVE identifiers have been directly associated with OSAMiner, as it does not exploit software vulnerabilities but rather relies on social engineering and user error to gain execution.

🔍 Detection Indicators

Known indicators include file hashes for the malicious DMG files (e.g., MD5: 2d8f5c7a9b1e4f3c6d0a2b9e8f7c6d5a as reported by Malwarebytes) and the LLMNR/HTTP requests to domains such as ‘osxupdate[.]com’ or ‘macupdate[.]net’. Behavioral signatures involve unexpected high CPU usage by processes named ‘osascript’ or ‘python’ without legitimate shell scripts running. Registry-like entries on macOS include the presence of a plist file named ‘com.apple.softwareupdate.plist’ inside ~/Library/LaunchAgents/, and the mutex/lock file ‘/tmp/.cryptominer.lock’.

☠️ Risk & Impact

The primary impact is degradation of system performance due to sustained CPU consumption, reducing battery life on laptops and potentially causing overheating or hardware damage over time. While OSAMiner does not exfiltrate files or credentials, the mining process consumes significant electricity and slows normal operations, affecting productivity. Affected sectors include individual consumers, small businesses, and educational institutions that handle macOS devices; no large-scale corporate breaches have been publicly attributed to this malware.

🛡️ Mitigation

To prevent OSAMiner infection, users should avoid downloading software from unofficial sources and disable the ‘Automatically run safe files’ option in Safari. Detection can be enhanced with endpoint detection and response (EDR) rules that flag high CPU usage by osascript or python with network connections to unknown mining pools. Yara rules based on the AppleScript payload patterns are recommended, alongside blocking known C2 domains at the network perimeter.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.