ChillyHell first surfaced on public malware repositories in early May 2025, although its developer-signed notarization dates back to 2021.

This modular backdoor has eluded detection by major antivirus vendors despite leveraging Apple’s own notarization process to appear legitimate.

By masquerading as a benign macOS applet, ChillyHell gains an initial foothold on target machines before deploying its sophisticated attack routines.

Jamf analysts noted that initial samples were delivered through compromised websites hosting what appeared to be productivity tools.

Once executed, the malware invokes a host-profiling routine that gathers detailed system information, including user directories, shell environments, and active process lists.

This reconnaissance allows the backdoor to tailor its next actions to the victim’s environment, minimizing the risk of execution errors on diverse macOS configurations.

Following this early analysis, Jamf researchers identified ChillyHell’s dual-stage persistence strategy.

In non-privileged contexts, it installs itself as a LaunchAgent, placing a plist under ~/Library/LaunchAgents/com.apple.qtop.plist and the main binary at ~/Library/com.apple.qtop/qtop.

When elevated privileges are available, it transitions to a LaunchDaemon, writing to /Library/LaunchDaemons/com.apple.qtop.plist and /usr/local/bin/qtop.

In either case, these mechanisms guarantee execution upon login or system boot, effectively transforming infected hosts into long-term assets.

In addition to launch services, ChillyHell incorporates a stealthy fallback by injecting a launch command into the user’s shell profile.

It detects the active shell—be it Zsh, Bash, or sh—then appends an invocation line to the appropriate RC file.

This ensures that even if launch services are disabled or removed, the malware reactivates during any new terminal session.

Persistence Tactics and Timestamp Manipulation

ChillyHell’s persistence routines are further bolstered by timestamp manipulation, designed to evade forensic analysis.

After creating its LaunchAgent or LaunchDaemon artifacts, the malware calls the _utime() system call to backdate creation and modification times.

If direct system calls fail due to insufficient permissions, it falls back to shell commands:-

touch -c -a -t 202101010000 /Library/LaunchDaemons/com.apple.qtop.plist
touch -c -m -t 202101010000 /usr/local/bin/qtop

This approach not only obscures the true installation date but can inadvertently manipulate APFS birth timestamps, making detection by timeline analysis tools more difficult.

By carefully selecting a date close to genuine system events, ChillyHell effectively hides its artifacts among legitimate OS updates and user-initiated changes.

Once persistence is established, ChillyHell proceeds to its main command loop, mainCycle(), after a randomized delay.

The backdoor alternates between HTTP and DNS transports, polling hardcoded C2 servers at 93.88.75.252 and 148.72.172.53 over ports 53, 80, 1001, and 8080.

Each cycle fetches new task descriptors, decodes Base64 payloads, and dynamically loads modules such as ModuleBackconnectShell for interactive reverse shells, ModuleUpdater for self-updating capabilities, and ModuleSUBF for local password brute-forcing.

By combining notarization abuse, multi-layered persistence mechanisms, and timestamp evasion, ChillyHell represents a significant advancement in macOS threats.

Cybersecurity teams should prioritize monitoring of LaunchService plists and shell RC files, as well as implement timeline analysis to detect anomalous file modification dates.

Continued collaboration between researchers and platform vendors is essential to mitigate the evolving tactics of notarized macOS malware.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post ChillyHell macOS Malware Profiles Compromised Machines and Maintain Persistence with 3 Methods appeared first on Cyber Security News.

A novel malicious Chrome extension has been uncovered targeting digital marketers by masquerading as a productivity tool for Meta ad campaigns.

Dubbed “Madgicx Plus,” this extension is distributed through a network of deceptive websites posing as legitimate AI-driven advertising platforms.

Rather than optimizing ad performance, the extension leverages powerful browser permissions to hijack user sessions and exfiltrate login tokens for Facebook and Instagram.

The campaign’s operators have repurposed infrastructure from previous malicious extensions, demonstrating an evolving threat that adapts social engineering lures to current digital marketing trends.

The extension’s distribution channels deploy professionally crafted domains—such as privacy-shield.world and madgicxads.world—that mimic real analytics and optimization services.

Visitors are encouraged to install the extension under the pretense of boosting campaign ROI, only to grant it full host access and network request interception capabilities.

Cybereason analysts noted that once installed, the extension injects content scripts into every visited page, enabling real-time harvesting of form inputs and session cookies.

This level of access allows attackers to bypass content security policies and interact directly with Meta’s internal APIs.

Impact assessments reveal that compromised credentials can lead to unauthorized modifications of advertising budgets, creation of new campaigns, and full takeover of business accounts.

Small and medium enterprises, often lacking dedicated security teams, are at particularly high risk as they routinely delegate ad management to third-party tools.

The ease with which the extension strips the HTTP Origin header from outbound requests further illustrates its capacity for seamless man-in-the-browser attacks.

Victims may remain unaware until they observe unexplained billing charges or missing campaigns in their Meta Business Manager dashboards.

Under the guise of a legitimate tool, the extension’s manifest.json grants host_permissions for “” and leverages declarativeNetRequest rules to remove origin headers from any request matching the pattern “caller=ext.”

This capability, combined with background scripts that forward stolen tokens to a command-and-control server, underpins a sophisticated data theft framework.

The real IP addresses behind the Cloudflare proxies were identified through favicon hash analysis and Shodan queries, leading to infrastructure owned by VDSina—an ISP previously linked to hosting malicious resources.

Infection Mechanism

Upon installation, the extension’s manifest triggers automatic injection of a background script that monitors browser navigation events.

The snippet below illustrates how the extension intercepts form submissions to capture authentication tokens:-

// manifest.json excerpt
{
  "host_permissions": ["<all_urls>"],
  "permissions": ["declarativeNetRequest","declarativeNetRequestWithHostAccess"],
  "content_scripts": [
    {
      "matches": ["*://*/*"],
      "js": ["background.iife.js"]
    }
  ]
}

The core of the attack resides in background.iife.js, which establishes listeners for XHR requests to Facebook’s OAuth endpoints.

When the user logs in, the script extracts the “access_token” from the JSON response and stores it in local storage before relaying it to the malicious C2 domain at madgicx-plus.com.

By stripping the Origin header with a declarativeNetRequest rule, the extension evades same-origin checks and seamlessly integrates stolen tokens into attacker-controlled sessions:-

// background.iife.js snippet
chrome.webRequest.onBeforeSendHeaders.addListener(details => {
  details.requestHeaders = details.requestHeaders.filter(h => h.name !== 'Origin');
  return { requestHeaders: details.requestHeaders };
}, {urls: ["*://*.facebook.com/*"]}, ["blocking","requestHeaders"]);

Through these mechanisms, attackers gain persistent access to the victim’s Meta environment without triggering standard browser alerts.

The extension’s combination of broad permissions, CSP bypass techniques, and covert token exfiltration marks a significant escalation in browser-based threats against social media advertises.

Security teams should prioritize extension audits, restrict unnecessary permissions, and isolate advertising workflows to dedicated profiles to mitigate such risks.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post Malicious Chrome Extension Attacking Users to Steal Meta Login Credentials appeared first on Cyber Security News.