Researchers Discovered a MacOS Version of the LightSpy Surveillance Framework 

By Lore Apostol / May 30, 2024

Security researchers say a previously considered iOS implant is actually a new macOS version. In April 2024, Blackberry reported the resurgence of the LightSpy mobile espionage campaign in Southern Asia and probably India, calling it an iOS implant. 

It showed advanced techniques such as certificate pinning to keep communication with its C2 server undetected and expanded capabilities, which include file theft from various apps like Telegram, QQ, or WeChat, audio recording, data harvesting, and system access.

Later that month, Huntress researchers discovered that it was a macOS variant of the LightSpy malware, showing macOS users could’ve been targeted. Yet, the researcher concluded that the analyzed sample only runs on Intel macOS or Apple Silicon devices that have Rosetta 2 enabled.

LightSpy became known due to an iOS version discovered in 2020, and even though the macOS version has many similarities, the latter seems to be more organized overall and exhibits significantly improved operational security and more matured development practices, as per Huntress.

Source: Huntress

To this research, ThreatFabric added more details of their own. The yet unknown threat group delivered implants for macOS via two publicly available exploits (CVE-2018-4233, CVE-2018-4404) targeting version 10 and supported 10 plugins to exfiltrate private data from affected systems.

Source: ThreatFabric

LightSpy is a complex, fully-featured modular surveillance toolset that primarily focuses on stealing victims’ private information, turning the infected device into a powerful spying tool. It can exfiltrate device information, saved files, hyper-specific GPS data, sound recording during VOIP calls, WeChat Pay payment history, as well as phone contacts, SMSs, call history, connected WiFi history, and Safari and Chrome browser history.

For a better user experience we recommend using a more modern browser. We support the latest version of the following browsers: For a better user experience we recommend using the latest version of the following browsers: