# Inside the BlueNoroff Web3 macOS Intrusion Analysis

BlueNoroff used a fake Zoom extension AppleScript to install a Nim/Go macOS backdoor, keylogger, and crypto-wallet infostealer on a crypto foundation employee's Mac.

- Payout: Real-world hack
- Severity: critical
- Program: macOS
- Credited: Huntress
- Disclosed: 2025-06-18
- Write-up quality: 8/10
- Original: https://www.huntress.com/blog/inside-bluenoroff-web3-intrusion-analysis
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-inside-bluenoroff-web3-intrusion-analysis
- Tags: domain:desktop impact:data-leak impact:funds-loss kind:incident platform:threat-intel sev:critical technique:chained technique:reverse-engineering vuln:info-disclosure vuln:rce vuln:secrets-leak

**Target:** macOS endpoint via AppleScript lure and signed Mach-O implants
**Root cause:** Victim ran an AppleScript disguised as a Zoom extension that downloaded and executed attacker binaries; implants abused debugger entitlements (com.apple.security.cs.debugger, get-task-allow) to inject payloads into sacrificial processes.
**Steps:**
1. Send Telegram message with Calendly link redirecting to fake Zoom domain `support.us05web-zoom.biz`
2. During deepfaked Zoom meeting, instruct victim to download `zoom_sdk_support.scpt` from `hxxps://support.us05web-zoom.biz/troubleshoot-issue-727318`
3. AppleScript opens legit Zoom SDK page, then after 10,500 blank lines curls second stage and runs it
4. Second stage disables bash history, installs Rosetta 2 if absent, writes `.pwd`, downloads `/tmp/icloud_helper`
5. Prompts for sudo password in a loop until valid, then wipes shell history
6. Persist via LaunchDaemon `/Library/LaunchDaemons/com.telegram2.update.agent.plist` running `/Library/Application Support/Frameworks/Telegram 2`
7. Root Troy V4 backdoor (`/Library/WebServer/bin/remoted`) polls C2 `http://$DOMAIN/update`, executes AppleScript/shell, queues commands until display sleeps
8. Loader `a` decrypts embedded payloads with PBKDF-derived AES-CFB key from password `gift123$%^`, then injects into spawned `cloudkit` via task_for_pid/mach_vm
9. Keylogger `keyboardd` uses CGEventTapCreate, captures clipboard and screens to `/private/tmp/google_cache.db`, exfils to `metamask.awaitingfor.site/update`
10. CryptoBot `airmond` enumerates browser wallet extensions (MetaMask, Phantom, OKX, etc.) and exfils to `productnews.online`
**How found:** Huntress was contacted by a partner after an end user reported downloading a suspicious Zoom extension; installing the EDR agent revealed the depth of the intrusion and the lure was traced back to a Telegram message received weeks earlier.
**Exploitation:** Social engineering via Telegram and deepfaked Zoom meeting convinced a crypto foundation employee to run a fake Zoom extension AppleScript; the script installed Rosetta 2, harvested sudo credentials, and dropped persistent signed implants that gave operators remote shell, keylogging, screen capture, clipboard theft, and crypto-wallet data exfiltration.
**Escalation:** Chained AppleScript lure -> sudo password capture -> persistent LaunchDaemon -> Go backdoor -> debugger-entitlement process injection -> keylogger/screencapture/clipboard -> dedicated crypto-wallet infostealer.
**Insight:** On macOS, check for binaries carrying both com.apple.security.cs.debugger and com.apple.security.get-task-allow entitlements—these enable task_for_pid-based injection into sacrificial processes; also hunt LaunchDaemons masquerading as app updaters and AppleScripts padded with thousands of blank lines to hide payloads.