UpdateAgent is uniquely characterized by its gradual upgrading of persistence techniques, a key feature that indicates this trojan will likely continue to use more sophisticated techniques in future campaigns. Like many information-stealers found on other platforms, the malware attempts to infiltrate macOS machines to steal data and it is associated with other types of malicious payloads, increasing the chances of multiple infections on a device.<\/p>\n\n\n\n
The trojan is likely distributed via drive-by downloads or advertisement pop-ups, which impersonate legitimate software such as video applications and support agents. This action of impersonating or bundling itself with legitimate software increases the likelihood that users are tricked into installing the malware. Once installed, UpdateAgent starts to collect system information that is then sent to its command-and-control (C2) server.<\/p>\n\n\n\n
Notably, the malware\u2019s developer has periodically updated the trojan over the last year to improve upon its initial functions and add new capabilities to the trojan\u2019s toolbox. The timeline below illustrates a series of techniques adopted by UpdateAgent from September 2020 through October 2021:<\/p>\n\n\n\n
![\"A](\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/02\/UpdateAgent-Timeline-1024x593.png\")
- September\u2013December 2020:<\/strong> The initial version of UpdateAgent was considered to be a fairly basic information-stealer. At the time, the malware was only capable of performing reconnaissance to scan and collect system information such as product names and versions. Once gathered, the data was then sent as heartbeats to the malware\u2019s C2 server.<\/li><\/ul>\n\n\n\n
- January\u2013February 2021:<\/strong> Approximately two months later, UpdateAgent maintained its original capabilities and added a new one: the ability to fetch secondary payloads as .dmg<\/em> files from public cloud infrastructure. DMG files are mountable disk images used to distribute software and apps to macOS, allowing the trojan to easily install additional programs on affected devices.<\/li><\/ul>\n\n\n\n
- March 2021:<\/strong> Upon its third update, the malware altered one of its prior functions to fetch secondary payloads as .zip<\/em> files instead of .dmg<\/em> files. The malware\u2019s developer also included two new capabilities: the ability to bypass Gatekeeper by removing the downloaded file\u2019s quarantine attribute and the ability to create a PLIST file that is added to the LaunchAgent<\/em> folder. The quarantine attribute forces Gatekeeper to block the launch of any file downloaded from the web or other unknown sources, and it also displays a pop-up warning that users cannot open the respective file as \u201cit is from an unidentified developer\u201d. By removing the attribute, the malware both prevented the pop-up message warning users and allowed the files to launch without being blocked by Gatekeeper. Moreover, as the LaunchAgent <\/em>folder specifies which apps and code automatically run each time a user signs into the machine, adding the malware\u2019s PLIST file allowed it to be included in these automatic launches for persistence upon users signing into the affected device.<\/li><\/ul>\n\n\n\n
- August 2021:<\/strong> The malware\u2019s fourth update further altered some of its prior capabilities. For one, it expanded its reconnaissance function to scan and collect System_profile and SPHardwaretype information. Additionally, UpdateAgent was changed to create and add PLIST files to the LaunchDaemon<\/em> folder instead of the LaunchAgent<\/em> folder. While targeting the LaunchDaemon <\/em>folder instead of the LaunchAgent <\/em>folder required administrative privileges, it permitted the malware to inject persistent code that ran as root. This code generally takes the form of background processes that don\u2019t interact with users, thus it also improved the trojan\u2019s evasiveness.<\/li><\/ul>\n\n\n\n
- October 2021:<\/strong> We detected the latest variants of UpdateAgent just over a year since its release into the wild. Sporting many of the updates found in the August 2021 variant, UpdateAgent still performed system reconnaissance, communicated with the C2 server as heartbeats, and bypassed Gatekeeper. Additionally, the October update expanded the malware\u2019s ability to fetch secondary payloads as both .dmg<\/em> or .zip<\/em> files from public cloud infrastructure, rather than choosing between filetypes. Among its new capabilities, UpdateAgent included the ability to enumerate LSQuarantineDataURLString using SQLite in order to validate whether the malware\u2019s downloaded app is within the Quarantine Events database where it would be assigned a quarantine attribute. The upgrade also allowed the malware to leverage existing user profiles to run commands requiring sudo access in addition to the ability to add arguments using PlistBuddy to create and edit PLIST files more easily. Lastly, the trojan included the ability to modify sudoers list, allowing the malware to bypass a prompt requiring high privilege user credentials while running UpdateAgent\u2019s downloaded app.<\/li><\/ul>\n\n\n\n
October 2021 Campaign<\/h3>\n\n\n\n
![\"The](\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/02\/UpdateAgent-Attack-Chain-1024x445.png\")
Figure 2. Attack chain of the latest UpdateAgent campaign<\/em><\/figcaption><\/figure>\n\n\n\n Upon analyzing UpdateAgent\u2019s infrastructure, we determined that the infrastructure used in the October 2021 campaign was created at the end of September 2021, and we also discovered additional domains with payloads. This indicates that the trojan is still in the developmental stage and is likely to add or modify its capabilities in future updates and continue its track of improving its overall level of sophistication.<\/p>\n\n\n\n
We further observed two separate variants of the UpdateAgent trojan in its October 2021 campaign. Each variant leveraged different tactics to infect a device, as detailed below:<\/p>\n\n\n\n
Variant 1<\/h3>\n\n\n\n
The first variant of UpdateAgent takes the following steps to infect a device:<\/p>\n\n\n\n
- A .zip <\/em>file named HelperModule.zip<\/em> downloads and installs UpdateAgent using a specific file path – \/Library\/Application Support\/xxx\/xxx. <\/em>This .zip<\/em> file is installed in \/Library\/Application Support\/Helper\/HelperModule.<\/em><\/li>
- UpdateAgent collects operating system and hardware information about the affected device. Once the compromised device connects to the C2 server, the trojan uses a curl <\/em>request to send this data to the C2 server.<\/li>
- Upon successful connection, UpdateAgent requests a secondary payload, usually a .dmg<\/em> or .zip<\/em> file, which is hosted on a CloudFront instance.<\/li>
- Once the secondary payload downloads, UpdateAgent uses the xattr <\/em>command – \/usr\/bin\/xattr -rc \/tmp\/setup.dmg, <\/em>to remove the quarantine attribute of downloaded files and bypass Gatekeeper controls.<\/li>
- UpdateAgent then extracts the secondary payload (.dmg <\/em>or .zip). <\/em>Once the file is mounted, it unzips and copies the payload files to a temporary folder, assigning executable permissions, and launches these files. UpdateAgent also uses PlistBuddy to create PLIST files under the LaunchAgent<\/em> folder to remain persistent through system restart.<\/li>
- UpdateAgent removes evidence by deleting the secondary payload, temporary folders, PLIST files, and all other downloaded artifacts.<\/li><\/ol>\n\n\n\n
Variant 2<\/h3>\n\n\n\n
The second variant of UpdateAgent takes the following steps to infect a device:<\/p>\n\n\n\n
- A third-party WebVideoPlayer application (WebVideoPlayer.pkg) with a post-install script downloads additional apps or .zip<\/em> files as \/Applications\/WebVideoPlayer.app\/Contents\/MacOS\/WebVideoPlayer<\/em>. Notably, this application included a valid certificate that was later revoked by Apple in October 2021.<\/li>
- The application scans the user profile to identify existing user IDs and assigned groups.<\/li>
- The WebVideoPlayer application uses SQLite3 commands to determine if the .pkg<\/em> file is within the Quarantine Events database, which contains URLs of downloaded files, mail addresses, and subjects for saved attachments.<\/li>
- The .pkg<\/em> payload extracts and drops UpdateAgent in \/Library\/Application Support\/WebVideoPlayer\/WebVideoPlayerAgent<\/em>.<\/li>
- The WebVideoPlayer application also assigns executable permissions to UpdateAgent and attempts to remove the quarantine attribute of the file using the xattr<\/em> command to bypass Gatekeeper controls.<\/li>
- The application then launches UpdateAgent and collects and sends the OS information to the attacker\u2019s C2 server. Like the first variant, the second variant sends curl<\/em> requests that download additional payloads, such as adware, and removes evidence by deleting all files and folders that it created.<\/li><\/ol>\n\n\n\n
Adload adware<\/h3>\n\n\n\n
UpdateAgent is further characterized by its ability to fetch secondary payloads that can increase the chances of multiple infections on a device, with the latest campaign pushing adware. We first observed UpdateAgent distributing adware as a secondary payload in its October 2021 campaign, identified as part of the Adload adware family by Microsoft Defender Antivirus.<\/p>\n\n\n\n
Similar to UpdateAgent, adware is often included in potentially unwanted or malicious software bundles that install the adware alongside impersonated or legitimate copies of free programs. In Adload\u2019s case, we previously observed the adware family targeting macOS users had spread via rogue installers often found on malicious websites.<\/p>\n\n\n\n
Once adware is installed, it uses ad injection software and techniques to intercept a device\u2019s online communications and redirect users\u2019 traffic through the adware operators\u2019 servers, injecting advertisements and promotions into webpages and search results. More specifically, Adload leverages a Person-in-The-Middle (PiTM) attack by installing a web proxy to hijack search engine results and inject advertisements into webpages, thereby siphoning ad revenue from official website holders to the adware operators.<\/p>\n\n\n\n
Adload is also an unusually persistent strain of adware. It is capable of opening a backdoor to download and install other adware and payloads in addition to harvesting system information that is sent to the attackers\u2019 C2 servers. Considering both UpdateAgent and Adload have the ability to install additional payloads, attackers can leverage either or both of these vectors to potentially deliver more dangerous threats to target systems in future campaigns.<\/p>\n\n\n\n
- October 2021:<\/strong> We detected the latest variants of UpdateAgent just over a year since its release into the wild. Sporting many of the updates found in the August 2021 variant, UpdateAgent still performed system reconnaissance, communicated with the C2 server as heartbeats, and bypassed Gatekeeper. Additionally, the October update expanded the malware\u2019s ability to fetch secondary payloads as both .dmg<\/em> or .zip<\/em> files from public cloud infrastructure, rather than choosing between filetypes. Among its new capabilities, UpdateAgent included the ability to enumerate LSQuarantineDataURLString using SQLite in order to validate whether the malware\u2019s downloaded app is within the Quarantine Events database where it would be assigned a quarantine attribute. The upgrade also allowed the malware to leverage existing user profiles to run commands requiring sudo access in addition to the ability to add arguments using PlistBuddy to create and edit PLIST files more easily. Lastly, the trojan included the ability to modify sudoers list, allowing the malware to bypass a prompt requiring high privilege user credentials while running UpdateAgent\u2019s downloaded app.<\/li><\/ul>\n\n\n\n
Defending against macOS threats<\/h2>\n\n\n\n
UpdateAgent\u2019s evolution displays the increasing complexity of threats across platforms. Its developers steadily improved the trojan over the last year, turning a basic information-stealer into a persistent and more sophisticated piece of malware. This threat also exemplifies the trend of common malware increasingly harboring more dangerous threats, a pattern also observed in other platforms. UpdateAgent\u2019s ability to gain access to a device can theoretically be leveraged by attackers to introduce potentially more dangerous payloads, emphasizing the need to identify and block threats such as this.<\/p>\n\n\n\n
Defenders can take the following mitigation steps to defend against this threat:<\/p>\n\n\n\n
- Encourage the use of Microsoft Edge<\/a>\u2014available on macOS and various platforms\u2014or other web browsers that support Microsoft Defender SmartScreen<\/a>, which identifies and blocks malicious websites, including phishing sites, scam sites, and sites that contain exploits and host malware.<\/li>
- Restrict access to privileged resources, such as LaunchDaemons <\/em>or LaunchAgents <\/em>folders and sudoers files, through OSX enterprise management solutions. This helps to mitigate common persistence and privilege escalation techniques.<\/li>
- Install apps from trusted sources only, such as a software platform\u2019s official app store. Third-party sources may have lax standards for the applications that they host, allowing malicious actors to upload and distribute malware.<\/li>
- Run the latest version of your operating systems and applications. Deploy the latest security updates as soon as they become available.<\/li><\/ul>\n\n\n\n
As organizational environments are intricate and heterogenous, running multiple applications, clouds, and devices, they require solutions that can protect across platforms. Microsoft Defender for Endpoint<\/a> offers cross-platform security and a unified investigation experience that gives customers visibility across all endpoints and enables them to detect, manage, respond, and remediate threats, such as the capability to detect UpdateAgent\u2019s anomalous use of PlistBuddy.<\/p>\n\n\n\n
- Turn on cloud-delivered protection<\/a> and automatic sample submission<\/a> on Microsoft Defender Antivirus. These capabilities use artificial intelligence and machine learning to quickly identify and stop new and unknown threats. <\/li>
- Enable potentially unwanted application (PUA) protectio<\/a>n in block mode to automatically quarantine PUAs like adware. PUA blocking takes effect on endpoint clients after the next signature update or computer restart. PUA blocking takes effect on endpoint clients after the next signature update or computer restart.<\/li>
- Turn on network protection<\/a> to block connections to malicious domains and IP addresses.<\/li><\/ul>\n\n\n\n
Defender for Endpoint\u2019s next-generation protection reinforces network security perimeters and includes antimalware capabilities to catch emerging threats, including UpdateAgent and its secondary payloads, C2 communications, and other malicious artifacts affiliated with the trojan\u2019s reconnaissance activities. Moreover, macOS antimalware detections provide insight into where a threat originated and how the malicious process or activity was created, providing security teams a comprehensive view of incidents and attack chains.<\/p>\n\n\n\n
Finally, this research underscores the importance of understanding a macOS threat\u2019s progression to not only remedy its current abilities, but to prepare for increased capabilities and sophistication of the threat. As threats on other OS platforms continue to grow, our security solutions must secure users\u2019 computing experiences be it a Windows or non-Windows machine. By sharing our research and other forms of threat intelligence, collaboration across the larger security community can aid in enriching our protection technologies, regardless of the platform or device in use.<\/p>\n\n\n\n
Detection details<\/h3>\n\n\n\n
Antivirus<\/strong><\/p>\n\n\n\n
Microsoft Defender Antivirus detects threat components and behavior as the following malware:<\/p>\n\n\n\n
- Trojan:MacOS\/UpdateAgent.B<\/a><\/li>
- Trojan:MacOS\/UpdateAgent.A<\/a><\/li>
- Trojan:MacOS\/Agent.A<\/a><\/li>
- Adware:MacOS\/Adload.A<\/a><\/li>
- Behavior:MacOS\/UpdateAgent.B<\/a><\/li><\/ul>\n\n\n\n
Endpoint detection and response (EDR)<\/strong><\/p>\n\n\n\n
Alerts with the following titles in the Microsoft 365 Security Center can indicate threat activity within your network:<\/p>\n\n\n\n
- macOS Gatekeeper bypass<\/li>
- Executable permission added to file or directory<\/li>
- Suspicious database access<\/li>
- Suspicious System Hardware Discovery<\/li>
- Suspicious binary dropped and launched<\/li><\/ul>\n\n\n\n
Advanced hunting<\/h3>\n\n\n\n
To locate activity related to UpdateAgent, run the following advanced hunting queries in Microsoft 365 Defender or Microsoft Defender Security Center.<\/p>\n\n\n\n
File quarantine attribute<\/strong><\/p>\n\n\n\n
Look for file quarantine attribute removal for the specific packages involved in the campaign. <\/p>\n\n\n\n
DeviceProcessEvents\n| where FileName has \"xattr\" and (ProcessCommandLine has \"-rc Library\/Application Support\/WebVideoPlayer\/WebVideoPlayerAgent\" or ProcessCommandLine has \"-r -d \/Library\/Application Support\/Helper\/HelperModule\")<\/pre>\n\n\n\n
Quarantine Event database<\/strong><\/p>\n\n\n\n
Look for quarantine event database enumeration through sqlite3<\/em> for the packages involved in the campaign. <\/p>\n\n\n\n
DeviceProcessEvents\n| where FileName has \"sqlite3\" and ProcessCommandLine has \"WebVideoPlayer.pkg\"<\/pre>\n\n\n\n
Curl request<\/strong><\/p>\n\n\n\n
Look for UpdateAgent\u2019s curl requests.<\/p>\n\n\n\n
DeviceProcessEvents\n| where FileName has \"curl\" and ProcessCommandLine has \"--connect-timeout 900 -L\"<\/pre>\n\n\n\n
Indicators<\/h3>\n\n\n\n
Files (SHA-256)<\/strong><\/p>\n\n\n\n
- 1966d64e9a324428dec7b41aca852034cbe615be1179ccb256cf54a3e3e242ee<\/li>
- ef23a1870d84e164a4234074251205190a5dfda9f465c8eee6c7e0d6878c2b05<\/li>
- 519339e67b1d421d51a0f096e80a57083892bac8bb16c7e4db360bb0fda3cb11<\/li>
- cc2f246dda46b17e9302242879788aa114ee64327c8de43ef2b9ab56e8fb57b2<\/li>
- 5c1704367332a659f6e10d55d08a3e0ab1bd26aa97654365dc82575356c80502<\/li>
- c60e210f73d5335f57f367bd7e166ff4c17f1073fd331370eb63342ab1c82238<\/li>
- f01dec606db8f66489660615c777113f9b1180a09db2f5d19fb5bca7ba3c28c7<\/li>
- 4f1399e81571a1fa1dc822b468453122f89ac323e489f57487f6b174940e9c2e<\/li>
- 9863bc1917af1622fdeebb3bcde3f7bebabcb6ef13eae7b571c8a8784d708d57<\/li>
- a1fba0bb0f52f25267c38257545834a70b82dbc98863aee01865a2661f814723<\/li>
- 81cfa53222fa473d91e2a7d3a9591470480d17535d49d91a1d4a7836ec943d3a<\/li>
- 78b4478cd3f91c42333561abb9b09730a88154084947182b2ec969995b25ad78<\/li>
- 91824c6a36ef60881b4f502102b0c068c8a3acd4bceb86eb4ffd1043f7990763<\/li>
- 86b45b861a8f0855c97cc38d2be341cc76b4bc1854c0b42bdca573b39da026ac<\/li>
- 84ff961552abd742cc2393dde20b7b3b7b2cfb0019c80a02ac24de6d5fcc0db4<\/li>
- 0ee6c8fd43c03e8dc7ea081dfa428f22209ed658f4ae358b867de02030cfc69b<\/li>
- 443b6173ddfbcc3f19d69f60a1e5d72d68d28b7323fe2953d051b32b4171aa9a<\/li>
- 409f1b4aeb598d701f6f0ed3b49378422c860871536425f7835ed671ba4dd908<\/li>
- 77f084b5fc81c9c885a9b1683a12224642072f884df9e235b78941a1ad69b80d<\/li>
- cbabbbb270350d07444984aa0ce1bb47078370603229a3f03a431d6b7a815820<\/li>
- 053fbb833ac1287d21ae96b91d9f5a9cfdd553bc41f9929521d4043e91e96a98<\/li>
- 29e3d46867caddde8bb429ca578dd04e5d7112dd730cd69448e5fb54017a2e30<\/li>
- 356d429187716b9d5562fe6eee35ea60b252f1845724b0a7b740fbddec73350f<\/li>
- a98ecd8f482617670aaa7a5fd892caac2cfd7c3d2abb8e5c93d74c344fc5879c<\/li>
- c94760fe237da5786464ec250eadf6f7f687a3e7d1a47e0407811a586c6cb0fc<\/li>
- eb71d15308bfcc00f1b80bedbe1c73f1d9e96fd55c86cf420f1f4147f1604f67<\/li>
- 0c08992841d5a97e617e72ade0c992f8e8f0abc9265bdca6e09e4a3cb7cb4754<\/li>
- 738822e109f1b14413ee4af8d3d5b2219293ea1a387790f207d937ca11590a14<\/li>
- 0d9f861fe4910af8299ac3cb109646677049fa9f3188f52065a47e268438b107<\/li>
- a586ef06ab8dd6ad1df77b940028becd336a5764caf097103333975a637c51fa<\/li>
- 73a465170feed88048dbc0519fbd880aca6809659e011a5a171afd31fa05dc0b<\/li>
- d5c808926000bacb67ad2ccc4958b2896ea562f27c0e4fc4d592c5550e39a741<\/li>
- 7067e6a69a8f5fdbabfb00d03320cfc2f3584a83304cbeeca7e8edc3d57bbbd4<\/li>
- 939cebc99a50989ffbdbb2a6727b914fc9b2382589b4075a9fd3857e99a8c92a<\/li>
- c5017798275f054ae96c69f5dd0b378924c6504a70c399279bbf7f33d990d45b<\/li>
- 57d46205a5a1a5d6818ecd470b61a44aba0d935f256265f5a26d3ce791038fb4<\/li>
- e8d4be891c518898dd3ccdff4809895ed21558d90d415cee868bebdab2da7397<\/li>
- 9f1989a04936cd8de9f5f4cb1f5f573c1871b63737b42d18ac4fa337b089cbdc<\/li>
- b55c806367946a70d619f25e836b6883a36c9ad22d694a173866b57dfe8b29c9<\/li>
- e46b09b270552c7de1311a8b24e3fcc32c8db220c03ca0d8db05e08c76e536f1<\/li>
- f9842e31ed16fe0173875c38a41ed3a766041350b4efcd09da62718557ca3033<\/li>
- bad5dc1dd6ff19f9fb1af853a8989c1b0fdfeaa4c588443607de03fccf0e21c9<\/li><\/ul>\n\n\n\n
Download URLs<\/strong><\/p>\n\n\n\n
- hxxps:\/\/d35ep4bg5x8d5j[.]cloudfront[.]net\/pkg<\/li>
- hxxps:\/\/d7rp2fva69arq[.]cloudfront[.]net\/pkg<\/li>
- hxxps:\/\/daqi268hfl8ov[.]cloudfront[.]net\/pkg<\/li>
- hxxps:\/\/events[.]optimizerservices[.]com\/pkg<\/li>
- hxxps:\/\/ekogidekinvgwyzmeydw[.]s3[.]amazonaws[.]com\/OptimizerProcotolStatus[.]zip<\/li>
- hxxps:\/\/lnzjvpeyarvvvtljxsws[.]s3[.]amazonaws[.]com\/ConsoleSoftwareUpdateAgent[.]zip<\/li>
- hxxps:\/\/qqirhvehhnvuemxezfxc[.]s3[.]amazonaws[.]com\/ModuleAgent[.]zip<\/li>
- hxxps:\/\/dpqsxofvslaxjaiyjdok[.]s3[.]amazonaws[.]com\/ProtocolStatus[.]zip<\/li>
- hxxps:\/\/oldbrlauserz[.]s3[.]amazonaws[.]com\/setup[.]zip<\/li>
- hxxps:\/\/grxqorfazgqbmzeetpus[.]s3[.]amazonaws[.]com\/SetupUpdateAgent[.]zip<\/li>
- hxxps:\/\/phdhrhdsp[.]s3[.]amazonaws[.]com\/setup[.]zip<\/li>
- hxxps:\/\/xyxeaxtugahkwrcvbzsw[.]s3[.]amazonaws[.]com\/BundleAgent[.]zip<\/li>
- [.]s3[.]amazonaws[.]com\/GuideServices[.]zip<\/li>
- hxxps:\/\/tnkdcxekehzpnpvimdwquzwzgpehlnwgizrlmzev[.]s3[.]amazonaws[.]com\/HelperModule[.]zip<\/li>
- hxxps:\/\/svapnilpkasjmwtygfstkhsdfrraa[.]s3[.]amazonaws[.]com\/WizardUpdate[.]zip<\/li><\/ul>\n","protected":false},"excerpt":{"rendered":"
Our discovery and analysis of a sophisticated Mac trojan in October exposed a year-long evolution of a malware family\u2014and depicts the rising complexity of threats across platforms. <\/p>\n","protected":false},"author":68,"featured_media":106155,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"ms_queue_id":[],"ep_exclude_from_search":false,"_classifai_error":"","_classifai_text_to_speech_error":"","footnotes":""},"content-type":[3663],"topic":[3687],"products":[],"threat-intelligence":[3729],"tags":[3785],"coauthors":[3380],"class_list":["post-106089","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","content-type-research","topic-threat-intelligence","threat-intelligence-cloud-threats","tag-macos"],"yoast_head":"\n
The evolution of a Mac trojan: UpdateAgent\u2019s progression | Microsoft Security Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/02\/02\/the-evolution-of-a-mac-trojan-updateagents-progression\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"The evolution of a Mac trojan: UpdateAgent\u2019s progression | Microsoft Security Blog\" \/>\n<meta property=\"og:description\" content=\"Our discovery and analysis of a sophisticated Mac trojan in October exposed a year-long evolution of a malware family\u2014and depicts the rising complexity of threats across platforms.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/02\/02\/the-evolution-of-a-mac-trojan-updateagents-progression\/\" \/>\n<meta property=\"og:site_name\" content=\"Microsoft Security Blog\" \/>\n<meta property=\"article:published_time\" content=\"2022-02-02T17:00:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-06-26T22:56:32+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/02\/UpdateAgent-attack-chain-social.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1345\" \/>\n\t<meta property=\"og:image:height\" content=\"680\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Microsoft Threat Intelligence\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/02\/UpdateAgent-attack-chain-social.png\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Microsoft Threat Intelligence\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"13 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/02\/02\/the-evolution-of-a-mac-trojan-updateagents-progression\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/02\/02\/the-evolution-of-a-mac-trojan-updateagents-progression\/\"},\"author\":[{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/author\/microsoft-security-threat-intelligence\/\",\"@type\":\"Person\",\"@name\":\"Microsoft Threat Intelligence\"}],\"headline\":\"The evolution of a Mac trojan: UpdateAgent\u2019s progression\",\"datePublished\":\"2022-02-02T17:00:00+00:00\",\"dateModified\":\"2023-06-26T22:56:32+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/02\/02\/the-evolution-of-a-mac-trojan-updateagents-progression\/\"},\"wordCount\":3340,\"publisher\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/02\/02\/the-evolution-of-a-mac-trojan-updateagents-progression\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/02\/update-agent.jpg\",\"keywords\":[\"macOS\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/02\/02\/the-evolution-of-a-mac-trojan-updateagents-progression\/\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/02\/02\/the-evolution-of-a-mac-trojan-updateagents-progression\/\",\"name\":\"The evolution of a Mac trojan: UpdateAgent\u2019s progression | Microsoft Security Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/02\/02\/the-evolution-of-a-mac-trojan-updateagents-progression\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/02\/02\/the-evolution-of-a-mac-trojan-updateagents-progression\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/02\/update-agent.jpg\",\"datePublished\":\"2022-02-02T17:00:00+00:00\",\"dateModified\":\"2023-06-26T22:56:32+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/02\/02\/the-evolution-of-a-mac-trojan-updateagents-progression\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/02\/02\/the-evolution-of-a-mac-trojan-updateagents-progression\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/02\/02\/the-evolution-of-a-mac-trojan-updateagents-progression\/#primaryimage\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/02\/update-agent.jpg\",\"contentUrl\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/02\/update-agent.jpg\",\"width\":1200,\"height\":800},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/02\/02\/the-evolution-of-a-mac-trojan-updateagents-progression\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"The evolution of a Mac trojan: UpdateAgent\u2019s progression\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#website\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\",\"name\":\"Microsoft Security Blog\",\"description\":\"Expert coverage of cybersecurity topics\",\"publisher\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization\",\"name\":\"Microsoft Security Blog\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/08\/cropped-cropped-microsoft_logo_element.png\",\"contentUrl\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/08\/cropped-cropped-microsoft_logo_element.png\",\"width\":512,\"height\":512,\"caption\":\"Microsoft Security Blog\"},\"image\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#\/schema\/logo\/image\/\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"The evolution of a Mac trojan: UpdateAgent\u2019s progression | Microsoft Security Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/02\/02\/the-evolution-of-a-mac-trojan-updateagents-progression\/","og_locale":"en_US","og_type":"article","og_title":"The evolution of a Mac trojan: UpdateAgent\u2019s progression | Microsoft Security Blog","og_description":"Our discovery and analysis of a sophisticated Mac trojan in October exposed a year-long evolution of a malware family\u2014and depicts the rising complexity of threats across platforms.","og_url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/02\/02\/the-evolution-of-a-mac-trojan-updateagents-progression\/","og_site_name":"Microsoft Security Blog","article_published_time":"2022-02-02T17:00:00+00:00","article_modified_time":"2023-06-26T22:56:32+00:00","og_image":[{"width":1345,"height":680,"url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/02\/UpdateAgent-attack-chain-social.png","type":"image\/png"}],"author":"Microsoft Threat Intelligence","twitter_card":"summary_large_image","twitter_image":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/02\/UpdateAgent-attack-chain-social.png","twitter_misc":{"Written by":"Microsoft Threat Intelligence","Est. reading time":"13 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/02\/02\/the-evolution-of-a-mac-trojan-updateagents-progression\/#article","isPartOf":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/02\/02\/the-evolution-of-a-mac-trojan-updateagents-progression\/"},"author":[{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/author\/microsoft-security-threat-intelligence\/","@type":"Person","@name":"Microsoft Threat Intelligence"}],"headline":"The evolution of a Mac trojan: UpdateAgent\u2019s progression","datePublished":"2022-02-02T17:00:00+00:00","dateModified":"2023-06-26T22:56:32+00:00","mainEntityOfPage":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/02\/02\/the-evolution-of-a-mac-trojan-updateagents-progression\/"},"wordCount":3340,"publisher":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization"},"image":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/02\/02\/the-evolution-of-a-mac-trojan-updateagents-progression\/#primaryimage"},"thumbnailUrl":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/02\/update-agent.jpg","keywords":["macOS"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/02\/02\/the-evolution-of-a-mac-trojan-updateagents-progression\/","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/02\/02\/the-evolution-of-a-mac-trojan-updateagents-progression\/","name":"The evolution of a Mac trojan: UpdateAgent\u2019s progression | Microsoft Security Blog","isPartOf":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/02\/02\/the-evolution-of-a-mac-trojan-updateagents-progression\/#primaryimage"},"image":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/02\/02\/the-evolution-of-a-mac-trojan-updateagents-progression\/#primaryimage"},"thumbnailUrl":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/02\/update-agent.jpg","datePublished":"2022-02-02T17:00:00+00:00","dateModified":"2023-06-26T22:56:32+00:00","breadcrumb":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/02\/02\/the-evolution-of-a-mac-trojan-updateagents-progression\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/02\/02\/the-evolution-of-a-mac-trojan-updateagents-progression\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/02\/02\/the-evolution-of-a-mac-trojan-updateagents-progression\/#primaryimage","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/02\/update-agent.jpg","contentUrl":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/02\/update-agent.jpg","width":1200,"height":800},{"@type":"BreadcrumbList","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/02\/02\/the-evolution-of-a-mac-trojan-updateagents-progression\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/"},{"@type":"ListItem","position":2,"name":"The evolution of a Mac trojan: UpdateAgent\u2019s progression"}]},{"@type":"WebSite","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#website","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/","name":"Microsoft Security Blog","description":"Expert coverage of cybersecurity topics","publisher":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization","name":"Microsoft Security Blog","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/08\/cropped-cropped-microsoft_logo_element.png","contentUrl":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/08\/cropped-cropped-microsoft_logo_element.png","width":512,"height":512,"caption":"Microsoft Security Blog"},"image":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#\/schema\/logo\/image\/"}}]}},"msxcm_display_generated_audio":false,"distributor_meta":false,"distributor_terms":false,"distributor_media":false,"distributor_original_site_name":"Microsoft Security Blog","distributor_original_site_url":"https:\/\/www.microsoft.com\/en-us\/security\/blog","push-errors":false,"_links":{"self":[{"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/posts\/106089","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/users\/68"}],"replies":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/comments?post=106089"}],"version-history":[{"count":0,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/posts\/106089\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/media\/106155"}],"wp:attachment":[{"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/media?parent=106089"}],"wp:term":[{"taxonomy":"content-type","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/content-type?post=106089"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/topic?post=106089"},{"taxonomy":"products","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/products?post=106089"},{"taxonomy":"threat-intelligence","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/threat-intelligence?post=106089"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/tags?post=106089"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/coauthors?post=106089"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
- August 2021:<\/strong> The malware\u2019s fourth update further altered some of its prior capabilities. For one, it expanded its reconnaissance function to scan and collect System_profile and SPHardwaretype information. Additionally, UpdateAgent was changed to create and add PLIST files to the LaunchDaemon<\/em> folder instead of the LaunchAgent<\/em> folder. While targeting the LaunchDaemon <\/em>folder instead of the LaunchAgent <\/em>folder required administrative privileges, it permitted the malware to inject persistent code that ran as root. This code generally takes the form of background processes that don\u2019t interact with users, thus it also improved the trojan\u2019s evasiveness.<\/li><\/ul>\n\n\n\n
- March 2021:<\/strong> Upon its third update, the malware altered one of its prior functions to fetch secondary payloads as .zip<\/em> files instead of .dmg<\/em> files. The malware\u2019s developer also included two new capabilities: the ability to bypass Gatekeeper by removing the downloaded file\u2019s quarantine attribute and the ability to create a PLIST file that is added to the LaunchAgent<\/em> folder. The quarantine attribute forces Gatekeeper to block the launch of any file downloaded from the web or other unknown sources, and it also displays a pop-up warning that users cannot open the respective file as \u201cit is from an unidentified developer\u201d. By removing the attribute, the malware both prevented the pop-up message warning users and allowed the files to launch without being blocked by Gatekeeper. Moreover, as the LaunchAgent <\/em>folder specifies which apps and code automatically run each time a user signs into the machine, adding the malware\u2019s PLIST file allowed it to be included in these automatic launches for persistence upon users signing into the affected device.<\/li><\/ul>\n\n\n\n
- January\u2013February 2021:<\/strong> Approximately two months later, UpdateAgent maintained its original capabilities and added a new one: the ability to fetch secondary payloads as .dmg<\/em> files from public cloud infrastructure. DMG files are mountable disk images used to distribute software and apps to macOS, allowing the trojan to easily install additional programs on affected devices.<\/li><\/ul>\n\n\n\n