FruitFly

Executive Summary

FruitFly is an advanced macOS spyware that persists via launch agents, harvests credentials, keystrokes, screenshots, and exfiltrates data over encrypted channels. The malware’s stealthy behavior can enable attackers to gain elevated access and expand lateral movements within networks.

FruitFly is a macOS‑targeted spyware family first reported by the research group ObjSee in 2017. Its primary objective is to covertly gather sensitive user information and exfiltrate it from infected systems. The malware injects itself into legitimate system processes or installs as a launch agent, ensuring persistence across reboots while remaining difficult for users to detect. Once active, FruitFly enumerates the file system for documents, captures screenshots, logs keystrokes, and harvests stored passwords from the Keychain. Network activity is typically directed to hardened command‑and‑control (C2) servers over HTTPS or custom protocols, allowing adversaries to orchestrate further compromise on a larger scale. Impact extends beyond personal data theft: by compromising credential stores and system logs, FruitFly can provide attackers with administrative access, enabling lateral movement inside corporate networks. Its modular architecture and ability to obfuscate traffic make it a potent threat for both individual and enterprise macOS environments.

Key Capabilities

• Establishes persistence through launch agents or startup items
• Harvests stored passwords from macOS Keychain
• Logs keystrokes and captures screen contents
• Collects system and network information (hostname, IP, OS version)
• Exfiltrates collected data via HTTPS or custom C2 protocols
• Can inject code into legitimate processes to avoid detection

ATT&CK Techniques

Recommended Actions

• Deploy and maintain up‑to‑date anti‑malware solutions that detect known FruitFly signatures
• Block outbound connections to any domain or IP reported in the ObjSee 2017 dataset
• Enforce Least Privilege by reducing user rights on macOS devices
• Implement Application Layer Gateway filtering for suspicious HTTPS traffic
• Conduct periodic forensic scans for unknown launch agents and persistent scripts
• Educate users about phishing indicators that may deliver FruitFly variants

Suggested Tags