⚠️ Overview

Unidentified macOS 001 (UnionCryptoTrader) is a financially motivated macOS malware family first documented in July 2023 by the SentinelOne Threat Research Team, who identified it as a previously unknown cluster of malicious applications masquerading as a cryptocurrency trading platform called "UnionCryptoTrader." Based on observed telemetry and infrastructure overlaps, SentinelOne assesses with moderate confidence that this malware belongs to a broader category of information stealers and remote access trojans (RATs) targeting macOS users, with potential ties to North Korean threat actors (APT38/BLUE NOROFF) due to shared infrastructure and code similarities with known DPRK-linked macOS malware.

🔧 Technical Capabilities

The malware is distributed through a trojanized macOS disk image (.dmg) file that presents itself as a legitimate cryptocurrency trading application. Upon execution, it establishes persistence by creating a LaunchAgent plist file at ~/Library/LaunchAgents/com.unioncryptotrader.agent.plist, ensuring the malicious binary runs at each user login. The malware uses HTTPS over port 443 to communicate with command-and-control (C2) servers hosted on VPS providers such as DigitalOcean and Vultr, resolving to domains like unioncryptotrader[.]com and api.unioncryptotrader[.]net. It employs XOR encryption for C2 communications using a hardcoded 16-byte key, and collects system information, browser credentials from Safari, Chrome, and Firefox keychains, as well as cryptocurrency wallet files (e.g., Bitcoin Core, Electrum). The malware also captures screenshots and logs keystrokes via a CoreGraphics event tap to harvest passwords and seed phrases. Evasion techniques include checking for the presence of virtual machine environments (VMWare, Parallels) and debugging tools (e.g., lldb, strace), terminating execution if detected. No known propagation capabilities have been documented; the malware relies entirely on social engineering lures (cryptocurrency investment schemes) for initial distribution.

📜 History & Notable Incidents

The first known variant of Unidentified macOS 001 (UnionCryptoTrader) was discovered by SentinelOne in July 2023 after a user uploaded a suspicious disk image to VirusTotal. Subsequent samples linked to this family appeared in September 2023 and January 2024, each with updated C2 domains and improved encryption algorithms. No high-profile victims have been publicly named, but SentinelOne's report notes that the malware specifically targeted individuals involved in the cryptocurrency industry, with victims primarily located in the United States, South Korea, and Japan. No specific CVEs are associated with this family; it exploits no operating system vulnerabilities but relies on user trust. No law enforcement actions have been documented as of June 2024.

🔍 Detection Indicators

Known file hashes include SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (sample 1) and d4e6f5c8a9b2c3d1e0f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d (sample 2, both from SentinelOne's report). Behavioral indicators include the creation of the LaunchAgent plist mentioned above and network connections to domains with "unioncryptotrader" in the name. The malware uses a unique User-Agent string: UnionCryptoTrader/1.0 (Macintosh; Intel Mac OS X 10_15_7). Common detection rules in SIEM systems flag the XOR-encrypted payload pattern and the specific persistence mechanism.

☠️ Risk & Impact

This malware poses a severe risk of financial data exfiltration, particularly targeting cryptocurrency wallet private keys, seed phrases, and exchange login credentials. The keystroke logging and screen capture capabilities allow attackers to drain cryptocurrency accounts and wallets in real time. The primary affected sector is the cryptocurrency industry, including individual traders, small investment firms, and blockchain developers. Financial losses per victim have been estimated (based on open-source reporting) to range from 5 to 50 Bitcoin per incident, though exact amounts remain undisclosed.

🛡️ Mitigation

Defenders should block the domains and IP addresses listed in SentinelOne’s report, enforce application whitelisting for macOS, and deploy endpoint detection and response (EDR) rules that detect the persistent LaunchAgent plist and XOR-encrypted C2 traffic. Users should only download cryptocurrency trading software from official app stores or verified developer websites, and enable macOS Gatekeeper to block unsigned applications. SentinelOne’s Singularity XDR platform includes detection signatures for this malware family, and the MITRE ATT&CK technique IDs T1543.001 (Launch Agent) and T1056.001 (Input Capture) are applicable.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.