Threat Summary
Two OTX pulses converge on the same business risk: industrialized credential theft against users who hold high-value secrets. The MacSync pulse describes a macOS stealer-as-a-service evolved from Mac.c, now using malicious DMG images and compiled Objective-C/Swift droppers instead of noisy AppleScript staging. The lure set is aimed at cryptocurrency enthusiasts and developers, meaning browser cookies, keychain items, SSH keys, cloud CLI tokens, wallet files, and repo credentials are likely objectives. The pulse also references iCloud infrastructure abuse and a backdoor module, suggesting operators are blending commodity theft with remote access and resilient tasking.
The HookBot/ERMAC pulse shows the Android side of the same economy: Cerberus-derived banking malware branching into ERMAC and Hook, with a leaked builder, Laravel backend, and React panel enabling unrelated operators to stand up panels quickly. Default credentials and keys remaining in leaked deployments lower the barrier for copycats and increase the chance of overlapping infrastructure, reused certificates, and predictable panel paths. Collective objective: monetize access through credential harvesting, overlay theft, wallet draining, session cookie replay, and resale of validated identity material.
Threat Actor / Malware Profile
MacSync/AMOS-class macOS stealers typically distribute through trojanized DMGs, cracked tools, fake updates, developer utilities, or crypto-wallet themes. Payload behavior includes collecting browser databases, keychain material, Telegram/session data, crypto wallets, files under Documents/Desktop, system profiling, and exfiltration over HTTPS to actor infrastructure or abused cloud services. The reported move from AppleScript to Objective-C/Swift binaries reduces Apple Event visibility and can improve Gatekeeper/signature workflow abuse. Persistence for macOS stealers is often light but should be assumed: LaunchAgents, LaunchDaemons, login items, background task management, or a backdoor module for follow-on payloads.
HookBot/ERMAC lineage is Android banking malware sold as a service. Distribution is commonly smishing, droppers posing as banking/security apps, malicious ads, or sideloaded APKs. Payload behavior includes accessibility abuse, overlay attacks against banking and crypto wallet apps, SMS/contact theft, notification interception, keylogging, device admin persistence, and C2 polling for commands. The source leak matters because it can create many low-sophistication operators using the same panel stack, default keys, Docker deployment patterns, and infrastructure naming conventions. DukeEugene is associated in the pulse with HookBot ecosystem activity; treat attribution as operational rather than exclusive because leaked tooling decentralizes control.
IOC Analysis
Indicator types present are file hashes, domains, and hostnames. MacSync indicators are MD5 file hashes only in the sample, with 45 total indicators in OTX; MD5 is weak for collision resistance but still useful for exact-match blocking and retrospective triage when combined with path, signer, bundle ID, and process ancestry. HookBot/ERMAC indicators include domains such as havijmail.com and hostnames such as ces.yeyr.lol, errr.onllee.com, and www.racon.online plus MD5s. SOC teams should push hashes to EDR block lists, add domains/hostnames to DNS sinkhole, proxy, and TLS inspection where legal, and pivot in OTX for full indicator sets rather than relying only on samples.
Operationalize by separating high-confidence block indicators from hunt-only leads. Hashes can be blocked immediately if source confidence is high. Domains should be blocked at DNS and web egress, then used for retroactive lookup in proxy, DNS, EDR network, and identity logs. For macOS, decode DMG provenance with quarantine attributes, spctl, codesign, sysdiagnose/log show, and MDE process trees. For Android/mobile, enrich with Mobile Threat Defense, Google Play Protect telemetry, MDM app inventories, accessibility service grants, and suspicious APK install sources.
Detection Engineering
---
title: MacSync macOS Stealer DMG Execution and Compiled Dropper
id: 9f2b7a5d-macsync-dmg-dropper-0001
status: experimental
description: Detects suspicious macOS DMG-mounted app execution followed by compiled Objective-C/Swift binary behavior associated with MacSync/AMOS style stealers.
author: Security Arsenal
logsource:
product: macos
category: process_creation
level: high
falsepositives:
- Legitimate developer builds and signed internal tools
fields:
- Image
- CommandLine
- ParentImage
- User
- Hashes
detection:
selection_dmg_mount:
CommandLine|contains:
- 'hdiutil attach'
- '/Volumes/'
- '.dmg'
selection_dropper_exec:
Image|endswith:
- '.app/Contents/MacOS/'
- '/usr/bin/curl'
- '/usr/bin/osascript'
- 'swift'
CommandLine|contains:
- 'crypto'
- 'wallet'
- 'keychain'
- 'iCloud'
- 'telegram'
- 'cookies'
condition: selection_dmg_mount or selection_dropper_exec
tags:
- attack.execution
- attack.t1059
- attack.t1204
- attack.collection
- attack.t1005
- macsync
- amos
---
title: HookBot ERMAC Android C2 or Leaked Panel Infrastructure
id: 7b3f0c2e-hookbot-ermac-c2-0002
status: experimental
description: Detects egress to HookBot/ERMAC pulse infrastructure and generic leaked Android banking panel communications.
author: Security Arsenal
logsource:
category: proxy
level: critical
falsepositives:
- Threat research sandboxes and intelligence pivots
fields:
- c-uri
- cs-host
- src_ip
- http_method
- sc-status
detection:
selection_known_hosts:
cs-host|contains:
- 'havijmail.com'
- 'ces.yeyr.lol'
- 'errr.onllee.com'
- 'www.racon.online'
selection_panel_like:
c-uri|contains:
- '/api/'
- '/panel'
- '/admin'
- '/bot'
- '/gate.php'
- '/inject'
cs-method: 'POST'
condition: selection_known_hosts or (selection_panel_like and 1 of selection_known_hosts)
tags:
- attack.command_and_control
- attack.t1071
- attack.t1102
- attack.credential_access
- attack.t1417
- ermac
- hookbot
---
title: macOS Credential and Keychain Collection Followed by Exfiltration
id: 4ad61d90-macos-cred-exfil-0003
status: experimental
description: Detects processes accessing browser credential stores, keychain, wallets, SSH or cloud tokens followed by outbound transfer behavior.
author: Security Arsenal
logsource:
product: macos
category: file_event
level: high
falsepositives:
- Password managers, backup agents, MDM inventory, developer debugging
fields:
- TargetFilename
- Image
- User
- CommandLine
detection:
selection_sensitive_paths:
TargetFilename|contains:
- '/Library/Keychains/'
- '/Application Support/Google/Chrome/'
- '/Application Support/Firefox/Profiles/'
- '/Library/Application Support/BraveSoftware/'
- '/.ssh/'
- '/.aws/credentials'
- '/.config/gcloud/'
- 'Login Data'
- 'Cookies'
- 'wallet'
selection_suspicious_reader:
Image|endswith:
- '/usr/bin/curl'
- '/usr/bin/python'
- '/usr/bin/python3'
- '/usr/bin/osascript'
- '/bin/zsh'
- '.app/Contents/MacOS/'
condition: selection_sensitive_paths and selection_suspicious_reader
tags:
- attack.credential_access
- attack.t1555
- attack.t1552
- attack.collection
- attack.t1560
- attack.exfiltration
- attack.t1041
let HookHosts = dynamic(["havijmail.com","ces.yeyr.lol","errr.onllee.com","www.racon.online"]);
let MacHashes = dynamic(["26a0f7cdb9f7dc5ace9a40af825b1538","2d69812584269699fade26622e6490c5","7df1049cbd56c0bfa4a3364a379b4c2c","9f15fe9c4415cd668334339f705b94d8","fb90887592655a8c989e443c640167aa","6791dad263cac6d63ebba6a4b57e7d71","3ded1d71a822b53b12c3b67bcaf633f5","781ce50001d4b449600afa347c9b0208","0452650b0b1e7eeaf01bd74e927a4dd7","90a61dcc76d704b2e861a0465ced2f87"]);
union
(DeviceNetworkEvents
| extend Indicator = coalesce(RemoteUrl, RemoteIP), Evidence = InitiatingProcessCommandLine, HashValue = InitiatingProcessMD5, Process = InitiatingProcessFileName
| where Indicator has_any (HookHosts) or HashValue in~ (MacHashes)
| project TimeGenerated, DeviceName, EventType="Network", Process, Indicator, HashValue, Evidence),
(DeviceProcessEvents
| extend Indicator = FileName, Evidence = ProcessCommandLine, HashValue = MD5, Process = FileName
| where HashValue in~ (MacHashes)
or Evidence has_any ("hdiutil attach","/Volumes/","keychain","Login Data","Cookies",".ssh",".aws/credentials","iCloud","wallet","telegram")
or Process has_any ("curl","osascript","python","python3","swift","zsh")
| project TimeGenerated, DeviceName, EventType="Process", Process, Indicator, HashValue, Evidence)
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Hits=count(), Indicators=make_set(Indicator), Hashes=make_set(HashValue) by DeviceName, EventType, Process
| order by LastSeen desc
#!/usr/bin/env bash
# MacSync/AMOS + HookBot/ERMAC endpoint hunt for macOS and Linux egress visibility
set -u
HASHES='26a0f7cdb9f7dc5ace9a40af825b1538 2d69812584269699fade26622e6490c5 7df1049cbd56c0bfa4a3364a379b4c2c 9f15fe9c4415cd668334339f705b94d8 fb90887592655a8c989e443c640167aa 6791dad263cac6d63ebba6a4b57e7d71 3ded1d71a822b53b12c3b67bcaf633f5 781ce50001d4b449600afa347c9b0208 0452650b0b1e7eeaf01bd74e927a4dd7 90a61dcc76d704b2e861a0465ced2f87'
HOSTS='havijmail.com ces.yeyr.lol errr.onllee.com www.racon.online'
echo '[+] Hash sweep in user-writable and app locations'
for d in "$HOME/Downloads" "$HOME/Desktop" "$HOME/Documents" /Applications /tmp /var/tmp "$HOME/Library/Application Support"; do
[ -d "$d" ] || continue
find "$d" -type f -maxdepth 6 2>/dev/null | while read -r f; do
h=$(md5 -q "$f" 2>/dev/null || md5sum "$f" 2>/dev/null | awk '{print $1}')
case " $HASHES " in *" $h "*) echo "HIT hash=$h path=$f";; esac
done
done
echo '[+] Launch persistence review'
for p in "$HOME/Library/LaunchAgents" /Library/LaunchAgents /Library/LaunchDaemons; do
[ -d "$p" ] && grep -RInE 'curl|osascript|python|swift|wallet|keychain|iCloud|telegram|dmg|http' "$p" 2>/dev/null
done
launchctl list 2>/dev/null | grep -Ei 'sync|wallet|crypto|update|helper|icloud|telegram|hook|ermac' || true
echo '[+] Quarantine and recent DMG evidence'
[ -d "$HOME/Downloads" ] && find "$HOME/Downloads" -type f \( -iname '*.dmg' -o -iname '*.app' \) -maxdepth 3 -print0 2>/dev/null | xargs -0 -I{} sh -c 'echo FILE {}; xattr -p com.apple.quarantine {} 2>/dev/null || true; codesign -dv --verbose=2 {} 2>&1 | head -20 || true'
echo '[+] Live and cached network indicators'
for h in $HOSTS; do
dscacheutil -q host -a name "$h" 2>/dev/null | grep -v '^$' && echo "DNS_CACHE_HIT $h" || true
grep -RIn "$h" "$HOME/Library/Caches" /var/log 2>/dev/null | head -20 || true
done
(lsof -i -nP 2>/dev/null || netstat -anv 2>/dev/null) | grep -Ei 'ESTABLISHED|SYN_SENT' | head -200
echo '[+] Unified log credential/exfil process trace last 24h'
log show --last 24h --style compact --predicate 'process == "curl" OR process == "osascript" OR process == "python" OR process == "python3" OR eventMessage CONTAINS[c] "keychain" OR eventMessage CONTAINS[c] "Login Data" OR eventMessage CONTAINS[c] "Cookies" OR eventMessage CONTAINS[c] "wallet"' 2>/dev/null | head -300
Response Priorities
Immediate: add the listed MD5s to EDR exact-match blocking after validation, sinkhole and proxy-block havijmail.com, ces.yeyr.lol, errr.onllee.com, and www.racon.online, and hunt for DMG mounts followed by unsigned or newly created .app execution. Capture memory or triage packages for suspected MacSync hosts before cleanup because keychain and browser-database access may indicate completed theft.
24h: treat any hit on macOS stealers or Android banking infrastructure as credential exposure. Force resets for IdP, email, cloud consoles, code repositories, password managers, crypto exchange/wallet accounts, and SSH keys where the user had local material. Revoke session cookies and OAuth grants, require phishing-resistant MFA re-registration for impacted users, and check mobile devices for unknown APKs, accessibility services, device admin rights, and notification access.
1 week: harden the vector. Enforce Gatekeeper/notarization policy and block unsigned app execution where feasible, restrict DMG auto-mount and browser downloads for high-risk developer and finance groups, alert on LaunchAgent persistence creation, deploy DNS filtering with newly observed domain feeds, and require MDM/MTD controls that detect accessibility abuse and sideloaded APKs. For developers, move secrets to managed vaults, eliminate long-lived cloud tokens on endpoints, and add canary credentials to detect theft replay.
Related Resources
Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.