Hey folks,

I’ve been diving deep into macOS internals and threat modeling recently, and as part of my learning, I built an macOS cryptojacking malware. This tool is purely for research and red team training. It demonstrates how threat actors might attempt to mine cryptocurrency on macOS systems without user consent — useful for blue teams to understand, detect, and prevent.

Core Features:

• Cross-architecture support: Includes binaries for both Intel (x64) and Apple Silicon (arm64).
• Stealth operation: Designed to run quietly in the background with:
  • Low CPU usage thresholds to avoid raising system alerts
  • No user interface, making it invisible during normal system use
  • Mimicking legitimate apps (e.g. inside TotalAV.app) to blend in with trusted software
• Persistence: Simulated techniques for autostarting on boot using macOS-specific launch agents or scripts.
• Crypto mining: Demonstrates how background Monero mining might be configured on a victim system.
• Configuration file injection: Shows how settings can be embedded directly into hidden config paths.

Disclaimer:
This project is intended strictly for educational, ethical hacking, and cybersecurity research. Do not use it on machines you do not own or have explicit permission to test. Unauthorized deployment is illegal and unethical.

Stay safe and hack ethically 👨‍💻🍎

Join the discord for the source code