macOS.OSAMiner

Executive Summary

macOS.OSAMiner is a Monero mining trojan that has been active since at least 2015, exploiting run‑only AppleScripts to stealthily embed and execute its miner on macOS systems. The malware hijacks CPU and GPU resources without user consent, causing performance degradation and potential financial loss. Defenders should monitor anomalous CPU usage and block outbound traffic to known mining pool domains.

macOS.OSAMiner is a lightweight Monero mining trojan that first appeared in the wild in 2018, although analysis indicates it may have been circulating on macOS systems since at least 2015. The malware targets Mac users by exploiting the flexibility of AppleScript—a native scripting language on macOS—and hides its malicious payload within so‑called “run‑only” scripts. These scripts are bundled inside other scripts and executed without disclosure to normal static analysis tools, effectively obfuscating the miner’s presence for five years until researchers at SentinelLabs (2021) developed techniques to reverse these run‑only AppleScripts. A 2021 VMRay dynamic analysis study further confirmed that once executed, OSAMiner leverages the CPU and GPU on infected machines to mine Monero, siphoning valuable computational resources without user consent. Beyond its core cryptomining function, OSAMiner demonstrates several stealth tactics. By embedding its malicious code inside legitimate AppleScript files, it avoids detection by signature‑based detectors that primarily focus on binaries or network traffic patterns. The script injection technique also permits persistence across reboots, as any system event that triggers the AppleScript (for example a launch agent or cron job) will in turn execute the embedded miner. The malware’s use of run‑only scripts complicates behavioral analysis because these scripts do not expose their contents during initial execution unless specialized deobfuscation scripts are applied. The persistence and obfuscation mechanisms employed by OSAMiner highlight a broader trend among macOS cryptominers: they increasingly rely on native scripting capabilities to remain inconspicuous. The combination of stealthy script embedding, resource hijacking for mining, and the lack of standardized Apple event analysis tools makes OSAMiner a challenging threat to detect and mitigate without dedicated tooling or heightened monitoring. Overall, macOS.OSAMiner exemplifies the need for security teams to incorporate script‑based indicators into their detection logic and maintain vigilant monitoring of CPU utilization. By understanding its lifecycle—from initial infection via a benign‑looking AppleScript to sustained resource hijacking—defenders can devise more effective containment strategies against this class of malware.

Key Capabilities

• Cryptocurrency mining (Monero)
• Stealthy embedding of malicious payloads within run‑only AppleScripts
• Evasion of static analysis by using obfuscated script files
• Potential persistence via system events that trigger AppleScript execution

ATT&CK Techniques

Recommended Actions

• Monitor macOS endpoints for abnormal CPU and GPU usage spikes indicative of cryptomining
• Deploy endpoint detection & response (EDR) solutions capable of detecting injected or run‑only AppleScript code
• Block outbound connections to known Monero mining pool domains/IPs in firewall or proxy rules
• Apply macOS Gatekeeper restrictions to prevent execution of unsigned or unknown AppleScripts
• Educate users on the risks of executing scripts from non‑trusted sources
• Regularly update macOS and security software to patch vulnerabilities that may be exploited by similar malware

Suggested Tags