Skip to main content
Live Webinar with SANS (June 25)— Agentic CTI Automation for Fun & ProfitRegister Free
Mallory
MalwareUsed by 2 actors

macrasv2

macrasv2 is a macOS stealer payload used in the Lazarus Group’s North Korea-linked “Mach-O Man” malware kit, including activity attributed to the group’s Chollima/Famous Chollima cluster. It has been observed in ClickFix-style intrusion chains targeting high-value users such as fintech executives, cryptocurrency and Web3 professionals, developers, and other enterprise users, primarily on macOS systems. The infection flow described in the reporting begins with Telegram-delivered fake business meeting invitations, often impersonating Zoom, Microsoft Teams, or Google Meet, that direct victims to counterfeit meeting pages and trick them into pasting a malicious command into Terminal. Subsequent stages deploy native Mach-O binaries, perform host profiling, establish persistence via a LaunchAgent, and then load macrasv2 as the final stealer stage.

macrasv2 is described as harvesting browser-stored credentials, session cookies, SQLite-stored browser data, browser extension data, macOS Keychain entries, and other files of interest. Reporting also notes theft of data that could enable follow-on compromise of SaaS platforms and corporate systems. The malware packages stolen information into an archive named user_ext.zip and exfiltrates the collected data via the Telegram Bot API. In some reporting, the malware chain also runs a self-deletion script after exfiltration.

Associated artifacts and surrounding components mentioned in the same intrusion chain include the stager teamsSDK.bin, profiler modules such as D1YrHRTg.bin, and the persistence component minst2.bin, which creates a folder named “Antivirus Service,” drops a binary disguised as OneDrive, and installs the LaunchAgent com.onedrive.launcher.plist for execution at login. Researchers also reported operational weaknesses in the broader campaign infrastructure, including exposed Telegram bot tokens and buggy logic in some modules, but the high-confidence behavior directly attributed to macrasv2 is credential, cookie, browser, Keychain, and file theft with Telegram-based exfiltration on macOS.

Share:
For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

THREAT ACTORS

Groups observed using it

2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details
Lazarus

...before the eventual injection of the macrasv2 stealer. Aside from stealing browser-stored credentials and cookies, such a stealer also exfiltrates Keychain secrets and other files that would allow software-as-a-service platform breaches.

via scworldscworld.com
Contagious Interview

A payload called macrasv2 is downloaded next, acting as stealer targeting browser extension data, stored browser credentials and cookies, macOS Keychain entries, and other files of interest, and exfiltrating them via Telegram

via quetzal bitso blogquetzal.bitso.com
MITRE ATT&CK

Techniques & procedures

15 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques
T1566.002Spearphishing LinkEvidence1

Attacks commenced with the delivery of urgent meeting invites purportedly from business contacts or colleagues that include links diverting to fake Microsoft Teams, Zoom, or Google Meet websites

T1566.003Spearphishing via ServiceEvidence1

According to Eldritch, an attacker contacts a business leader through Telegram, often by using a compromised account belonging to a colleague or contact known to the target. The attacker sends the target a fake Zoom, Microsoft Teams, or Google Meet invitation to set up a conversation under the pretense of a business opportunity.

Execution

2 techniques
T1059Command and Scripting InterpreterEvidence1

The target joins the call and is prompted to enter a command to fix connection issues.

T1204User ExecutionEvidence1

The target joins the call and is prompted to enter a command to fix connection issues. Because the command is entered by the user, many traditional security controls remain untriggered.

Persistence

1 technique
T1547Boot or Logon Autostart ExecutionEvidence1

This is then followed by a persistence mechanism that re-invokes the malware kit at every login before the primary component, a stealer named "macrasv2," is loaded.

Privilege Escalation

1 technique
T1547Boot or Logon Autostart ExecutionEvidence1

This is then followed by a persistence mechanism that re-invokes the malware kit at every login before the primary component, a stealer named "macrasv2," is loaded.

Stealth

1 technique
T1070Indicator RemovalEvidence1

Macrasv2 then runs a self-deletion script and the infection chain is complete.

Credential Access

2 techniques
T1539Steal Web Session CookieEvidence5

It targets browser-stored credentials and cookies, macOS Keychain entries, and other files that can grant access to SaaS platforms

T1555Credentials from Password StoresEvidence5

It targets browser-stored credentials and cookies, macOS Keychain entries

Discovery

1 technique
T1083File and Directory DiscoveryEvidence2

Stage 4 – The Stealer ( macrasv2 ): Harvests browser credentials, session cookies, SQLite-stored data, and macOS Keychain entries

Collection

2 techniques
T1005Data from Local SystemEvidence2

such a stealer also exfiltrates Keychain secrets and other files that would allow software-as-a-service platform breaches

T1560Archive Collected DataEvidence3

then compresses them into an archive such as user_ext.zip.

Command and Control

2 techniques
T1071.001Web ProtocolsEvidence1

Registers the host with the C2 server ... exfiltrates it via the Telegram Bot API — a trusted channel that blends into normal traffic.

T1105Ingress Tool TransferEvidence2

Once the user enters the command and connects to attacker infrastructure, malware is downloaded as a macOS application .bin file under an unassuming name, like "teamsSDK.bin."

Exfiltration

2 techniques
T1041Exfiltration Over C2 ChannelEvidence1

Researchers note that parts of the kit are poorly written, with some profilers entering infinite loops that continuously POST the same data to command-and-control servers... The final stealer stage... aggregates high-value data from the system before exfiltration.

T1567Exfiltration Over Web ServiceEvidence3

Stage 4 – The Stealer ( macrasv2 ) ... exfiltrates it via the Telegram Bot API — a trusted channel that blends into normal traffic.

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app
Network
1 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting
domain●●●●●●●●●●●●View more in app2 months ago
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.
IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution2

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping15

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.