macOS "Open Gatekeeper Friendly" InfoStealer Malware



Background

This page attempts to cover and track a specific "variant" of AMOS/Poseidon, the ever-changing macOS stealers.

  • SentinelOne has a great write-up on these variants.
  • Objective-See has a great write-up on most of the macOS malware seen in 2024.

But this rentry page is dedicated to a specific subset of that infostealer -- malicious Open Gatekeeper friendly binaries distributed in pirated macOS apps. This info-stealing malware was recently caught on several macOS piracy trackers and can easily spread to anywhere macOS piracy is shared. These malicious releases are using pirated apps from known macOS piracy groups and repacking them to include a malicious binary named Open Gatekeeper friendly (or sometimes using a capital F, Friendly) . This is an effective way to infiltrate macOS pirates for two reasons:

  1. A file named Open Gatekeeper friendly is common in the macOS piracy world. The macOS piracy group "TNT" includes this file in all of their releases-- a script to automate the removal of gatekeeper-related extended attributes which keep the DMG and its content from opening or launching.
  2. The included apps and any patches, etc are from "clean" pirated macOS apps which work as expected. When cracked apps work as expected, there is less suspicion -- with things working, the release will continue to be shared with others.

These releases are often sourced from torrent trackers where the file(s) are seeded by compromised accounts. Tracker users unknowingly download the releases and things continue to spread from there. Only when the malicious Open Gatekeeper friendly binary is executed will the malware run and attempt to siphon information. If it were ignored and only the pirated app itself were used, nothing malicious is executed (at least in the "OGF" samples so far).

Any release groups or individuals who have their names attached to any of these releases have NOTHING to do with this malware and their original releases are all safe (assuming you're OK with piracy).

The malicious binaries aren't always visually obvious to spot -- it's advised to not run ANY "Open Gatekeeper friendly" file unless you know what you're doing.

Malicious Open Gatekeeper Friendly Binary

  • Named "Open Gatekeeper Friendly" (with capital F)
  • Included in a non-TNT release
  • No usual TNT DMG background
    MALICIOUS

Malicious Open Gatekeeper Friendly Binary Example 2

  • Named "Open Gatekeeper Friendly" (with capital F)
  • Included in a non-TNT release
    MALICIOUS

Malicious Open Gatekeeper Friendly Binary Example 3

  • Named "Open Gatekeeper Friendly" (with capital F)
  • Variation of the TNT DMG background image being used
    MALICIOUS

Malicious Open Gatekeeper Friendly Binary Example 4

  • Named "Open Gatekeeper Friendly" (with capital F)
  • Uses TNT background DMG image to look close to original TNT release
    MALICIOUS

Malicious Open Gatekeeper Friendly Binary Example 5

  • Named "Open Gatekeeper friendly" (to match original TNT version)
  • Uses TNT background DMG image to look close to original TNT release
  • Background and fonts slightly differ, but visually, most users would not notice anything is off
    MALICIOUS

Legit TNT Release

  • Named "Open Gatekeeper friendly" (with lowercase f)
  • Included with a TNT release
  • Includes usual TNT DMG background (why join the navy if you can be a pirate?)
  • HOWEVER -- USING BASIC VISUALS ALONE IS NOT ENOUGH TO DETERMINE IF THIS RELEASE IS LEGIT!!
    SAFE

Legit TNT Release

  • With List view set, "Open Gatekeeper friendly" is under 500KB in size
    SAFE

Legit TNT "Open Gatekeeper friendly" file viewed in hex editor

  • Plain-text bash script
  • Only running commands to clear extended attributes then mount included DMG
    SAFE

Behavior

While there are 20+ different malicious OGF binaries, there are only 2 main variants (so far):

  1. The osascript commands are included directly in the Open Gatekeeper Friendly binary.
  2. The Open Gatekeeper Friendly binary downloads a payload from a remote server which then executes the osascript commands.

If the binary is run, it will attempt to:

  1. Directly start running its malicious commands or download a remote payload from rgueapp.com
  2. Setup a random directory in /tmp
  3. Search and collect system info, browser data, Notes, crypto wallets, files in Desktop/Documents/Downloads
  4. Compress all collected data
  5. Attempt to send the compressed data to the following servers (depending on variant):
  • 81.19.135.54
  • 82.115.223.9
  • 85.209.11.155
  • 141.98.9.20
  • 141.98.9.203
  • 185.7.214.148
  • 193.124.185.54
  • zblong.com
  1. Remove all traces of collected itself if upload is successful

The "good" news is that this malware does not appear to be persistent -- it gets in and out, deleting all traces of itself when finished (for now, anyway).
See a more detailed breakdown of the behavior here.

Mitigations

Disable internet the moment you think you've been compromised to potentially avoid your data being uploaded.

  1. Avoid K'd macOS software or any software not in the Mac App Store or from official developer download pages.
  2. Avoid known infected releases.
  3. Avoid running "Open Gatekeeper Friendly" binaries which are packed with K'd content.
    • Yes, legit TNT releases use this file to help users bypass various Gatekeeper restrictions to make it easier for n00bs... but unless you're capable of determining which binaries are legit and which are malware, avoid 'em all and use other methods to disable Gatekeeper or remove quarantine extended attributes if the usual Terminal commands to manually do this aren't your thing.
  4. Monitor connections with LuLu or Little Snitch and/or block the following with a firewall:
    • This will only work if the IPs and domain remain the same, it'd be trivial to build new binaries or payloads which use something else.
  • rgueapp.com
  • zblong.com
  • 81.19.135.54
  • 82.115.223.9
  • 85.209.11.155
  • 141.98.9.20
  • 141.98.9.203
  • 185.7.214.148
  • 193.124.185.54

If you have run the file but believe the attack has been interrupted

  1. Before Compression:
    • Data will remain in /tmp/$randomNumbersNLetters but won't be sent.
  2. During Compression:
    • /tmp/out.zip may exist but will be incomplete.
  3. During Upload:
    • Remote server will likely receive an incomplete file.

Recommendations

  1. Kill processes with sudo pgrep -f "osascript|curl" | xargs kill -9 2>/dev/null || true
  2. Check /tmp (ls -la /tmp/) and look for a directory with random letters/numbers or anything suspicious, then remove.
  3. If evidence of the malware is found or you aren't sure and want to be safe, change account passwords etc.

Known Infected Releases

As of Feb 21 2025, all infected releases have been removed on the Russian trackers the releases were sourced from.. plus rutracker (not the source) also removed the remaining infected releases! Unfortunately, DHT is keeping some of these previous releases alive despite being removed from the tracker -- there are at least 2 sites/blogs still linking to some of these releases and are ignoring/deleting messages/comments asking for removal.

86 releases and counting...

cde447c2b2823cf6ffc57a507cb0c83c ACDSee.Photo.Studio.11.11.0.1.3155.TNT.dmg
5bf80ea3e65a3327504120d5833b3b6a Adobe Acrobat DC 24.004.20219.7.dmg
0515cd770e83e1cdf877dce4ea83176f Adobe Acrobat DC 24.005.20320.7 SICE.dmg
ac60b72617c8ce08931a4fd424ed4565 Adobe Acrobat Pro 24.006.20400.7.dmg
0a9d1c1182cb0365249c258d225d80a7 Adobe After Effects 25.1.dmg
780a8e7f52e43122a4e1eae2ba38b6a5 Adobe Bridge 15.0.2.dmg
70eb7db965b3bf0fb6213d6b99a80918 Adobe Illustrator 29.0.1 NAP.dmg
df69dc21cb6839286e247c2fa2dc462a Adobe Illustrator 29.2.1.dmg
975f8b188b4d075cb4631312d4a7e25e Adobe Illustrator 29.3.dmg
3baf2cdac31706752c00bc736e6b6962 Adobe Lightroom Classic v14.0.1.dmg
6919ea6c8f02f65ebfb1244ccd765600 Adobe Lightroom Classic 14.1.1.dmg
e67d6fc1b21539bde4d409bfcf6d9eb1 Adobe Lightroom Classic 14.2.dmg
f5e43c9817797242d5edaa58a61600ca Adobe Photoshop 26.1.dmg
c30ad49debf39d1e73350ee06d370e59 Adobe Photoshop 26.3.dmg
bb300ba91a09ba23fbd7af43247ad4b3 Adobe Premiere Pro 25.1.dmg
b913059ca1079f1e595d061bb6046b4d Affinity_Photo_2_2.5.6_[TNT].dmg
1b7314ca609aaf5fc3803e6e8f3921ef Camtasia_2025.0.0_[TNT].dmg
0d98df0fc37f039a9d83bead40e638bd Capture_One_Pro_16.5.0.29_[TNT].dmg
2646ce944459c3c7d76982f074ef59ba Capture_One_Pro_16.5.1.14_[TNT].dmg
62279f76554101c1879331d68743afc2 Capture_One_Pro_16.5.3.1_[TNT].dmg
62279f76554101c1879331d68743afc2 Capture_One_Pro_16_5_4_26.dmg
d79d030e383eccaf3142e593b9ab074c Capture One Pro 16.5.5.7. TNT.dmg
18590ff4d9eb846e9db01ab2cfd6537f CleanMyMac_5 5.0.3.dmg
d7f8b30accdebbd343e0a63b05b2d527 CleanMyMac 5.0.4(atb).dmg
7513e2b4602caee8e095377db6c27e01 CleanMyMac 5 5.0.4 [U2B Pre-K'ed]-20074.dmg
301caf8fef80ac87b3c94b90dddc5d5b CleanMyMac_5_5.0.5 .dmg
ee77106aabaeefb281a140c1687b25be Commander_One_PRO_3.11_[TNT].dmg
834528407c1044335ede352f3c0f4590 Cookie_7.5.2_TNT.dmg
5985e1fec1ae72b020672d24270e95a4 CorelDRAW v25.2.1.313.dmg
d94dcb61e7bbfc95af863158ae039a1f CrossOver_24.0.7_[TNT].dmg
d83dc8416db1dc4d2deae50928050d02 DaVinci_Resolve_Studio_19.1_Mac.dmg
53e69901cdab5d65cb6ff53edfd80835 DaVinci_Resolve_Studio_19.1.1_Mac.dmg
5d826945c11f9cb8344572b929e8062e DaVinci_Resolve_Studio_19.1.3_Mac.dmg
38e61a9f966dc748ad93f495bac4a006 Downie_4_4.8.13.dmg
76ff29ef57e8dcbe5a498153656e4e00 Downie_4_4.9.4_[TNT].dmg
54de5383819ac0f85e24673db24383d6 Dropover.4..5.2.TNT.MAC.OS.dmg
609f32ce2788d800aa5e1245c4da62cd DxO PhotoLab 8 8.3.0 TNT.dmg
660a35f80210b4d8f6410d11a2660526 Elmedia Player Pro 8 8.20 TNT.dmg
a100d252cdc50869bacdd56185c0d3d3 Final Cut Pro 11.0.1 MAS [TNT].dmg
7fd12c00e22acde8352b348709e9569a HitPaw Photo Object Remover 1.2.2.dmg
710f3cef66f532c9560033ea185f043f HitPaw Univd 4.7.0 [TNT].dmg
3545fb900228dbfe9480fe0b9e40cc47 iZotope Neutron 4 v4.6.0 macOS.dmg [plugintorrent.com]
cd358845f2a73beca5efad50f3833831 Infuse Pro 8.0.9 .dmg
4f13f092e9964b239b2e88939546ec12 Kaleidoscope+5.3.1.dmg
5da1f92636300487fb329a2d4443a22b Logic_Pro_11.1.2_MAS_[TNT].dmg
7da1f3fe263c4eea91fb8f8b4abe9492 Luminar Neo 1.21.0 18389.dmg
eb6be600da6c9ce2bd1bbf2583639f69 MacPilot 16.6.dmg
3956fcb658976ebb656a00991be70062 Magic.Disk.Cleaner.2.10.1.TNT.dmg
994cb72dd0d3f0023c9a11214bc993b6 Microsoft Office 2021 LTSC 16.88.dmg [programmiedovetrovarli.it]
db884a33213c5f85215c065d98966532 Microsoft Office 2024 v16.91.dmg
b1c01e6af780eecec99472bbdb2bf8bd Microsoft Office 2024 v16.92.dmg
ab5e9f5a141bded16d49b9659b9bca33 Microsoft Office 2024 v16.93.dmg
cb1e2369b35fb8e37dd45ef3ff098fda Microsoft Office 2024 v16.93.dmg
54ea56d857e0c57180f25d4734e06ff7 Microsoft Office 2024 v16.93.dmg
ab141aecb8382f4fd72e535ab78f7e90 Microsoft.Office.LTSC.Standard.for.Mac.OS.2024.v16.94.dmg
3e9kmo9eo782udnuxtmu3gy0a7g203zi Native Instruments Traktor Pro 4.0.2.13 HCiSO.dmg
cfc814271f4a355b9a96e609dd9b525f ParallelsDesktop-20.1.1-55740.dmg
5f37ea4e9c38e3ab9b8ae9403dc92ed9 Parallels Desktop 20.1.2-55742.dmg
8c1ca9899a3850f0302f2b4c2b76237d ParallelsDesktop-20.2.0.dmg
4ea84e372a43fbbff37b83871901f323 ParallelsDesktop-20.2.1-55876.dmg
4160a04b0c955dad66ea9390dc4c3278 PDFelement_11_4_7_TNT.dmg
ea795c69ff68af3ea67dbf5f841dac1a PDF Expert 3.10.10.dmg
876f3be21d8d205b30993791d9cacf37 PDF_Reader_Pro_4.7.8_TNT.dmg
b0c0a1a7947292ac25f2c4121cc0eb1f PDF_Reader_Pro_4_7_8_TNT.dmg
4e2d664b4f1b75db36e439c3a19aa21b Perfectly_Clear_Workbench_v4_4.6.1.2717_[TNT].dmg
3396c6e4d56a0266b054548d6e2b8586 Perfectly_Clear_Workbench_v4_4_6_1_TNT.dmg
35bc532aa6f481343a567eb46a8fabaf Perfectly Clear Workbench 4.6.1 2711.dmg
443257c0a93446003caea3b686848565 Pixelmator_Pro_3.6.15.dmg
e91b0cc7561c4d032d0da55c4285ce83 PowerPhotos_2.7.4_[TNT].dmg
277903ae4a92fdeb120ce4ded0fbad8f Pro Microphone 1.7.0.dmg
3a4c7b4100da50ee20a759e9778adf45 PullTube 1.8.5.54.dmg
33b473f553b60d4472d7a9a59af18324 Rhino 8.12.24282 macOS.dmg
f1e92de57afd62fd6b459b94f8f63344 Rhino_8_8_16_TNT.dmg
11597e52af783daead3ca7b20c02174e RipX.DAW.PRO.7.5.1.dmg
1770ca98ae752169f50379c28b11f40c SILKYPIX.JPEG.Photography.11E.TNT.dmg
d841c91d1d1cb3a9eda3f6e6ddeddc27 Sketch_101.8_[TNT].dmg
143c373f1f4bc121c1ae164b04f0c101 SketchUp_2024_598-243_(24.0.598)_[TNT].dmg
030f983c60b498e199d6f0d2629186f0 Topaz Gigapixel AI 7.4.4.dmg
949c3b25076469ffdde6dbf9137a13e8 Topaz Gigapixel v8.0.0 macOS.dmg
9717b403c7c4ca5c33d4d427311d7e96 Topaz Video AI 5.3.5 macOS.dmg
3a3f8829dee2c1187919cd10f31f6ce4 Valentina Studio 14.7.1.dmg
8f3b0a8286ef892c6b68bdc0bde12878 WiFi.Explorer.Pro.3.6.9.TNT.dmg
88eb3ed4d295e5ea0296d090c158a0e0 Wondershare PDFelement Pro 11.1.3.dmg
81f0e73cdf76b63ca777727b68c8eba8 Wondershare Recoverit 13.0.7.14 [TNT].dmg
380c4478fbda2aabf2f163e0db7e4bed XLN_Audio_XO_1.7.1.dmg
0041b628e66c59e25f2dac8a95405931 zBrush 2024.0.2.dmg

Known Malicious Binaries

These are the "Open Gatekeeper Friendly" binaries included in the known infected releases listed above
Nearly all of the infected releases above use one of these binaries

4bab216dadd5b1431717f1a5147c29bcfea636044946a05fb675da78b8523632 [VirusTotal]
a6821d95007d2877cd66e0044d21d9052747b2a4e47edbd3b48cbb75d990d3ce [VirusTotal]
dd7dbbb66ff8453aff457e8ae74c9b0e1987c6106d2ad3f58435d7af5d49dc09 [VirusTotal]
3120e8bad3dec99d34ee0fdc0df76fe8c3da71544b38fa6bbb24a123374d3dea [VirusTotal]
d80b443ae39b4bc7e767f1f8ab4846dd65b874ac59ec483e3858b9c805473f54 [VirusTotal]
864d183968a47b01f099a3e6be956833ff720c0473bd46b61174401bea07dbbd [VirusTotal]
a4d29aa32fbec60fcdba47515c6d39dac9a6a880edd454dccf10006df2b3bca8 [VirusTotal]
736afa6e409219cf79910b5f5101a76da563453aee74f0d38371ee376546b85f [VirusTotal]
5d5f04445e80db9841c9e78bee1a81a89c71cba47e053853fdedf29fd66d8437 [VirusTotal]
1e39d447b073d4f95a6949d18bdc8580facaa28b0b7a2085adf0724899750905 [VirusTotal]
54c6600f76f291e4455716beacd6516866d005a38ce4ef966e3080aa03ea2d0f [VirusTotal]
15b8627fb6d34403056b8c30393a2b7e16c85546acd75aa52375818f47647b9c [VirusTotal]
6be9ef2aa180560b63588c0caf19ec36a35e05776396d835c6faca6624908c8f [VirusTotal]
a8e772f4e98fc7038de48c9a8ebf74b0d192c550503710a762f5aa68167402f8 [VirusTotal]
f2ca9f8e5f8b3a3b5ba6d6c7cef3e048e3638c0ba14c97787111be66f74d292f [VirusTotal]
841d76ddcb9460c32e0238aaab24100747375612733ac5634c8e03af56b4e990 [VirusTotal]
0f1317f82cd35ab6ec90065b4a6c071665ac3031827e6a3ccc3abe7606f430a6 [VirusTotal]
c0ad0f9cccd9db5a374f626cbef7ca169e20ecd53010823c7ce57fdd356f383d [VirusTotal]
7c5ccd13f9d7815defff28a1b9dffc89c823465a4e478f0e57cf5c6705f0095b [VirusTotal]
6e97b23d16aa4aa25d0cfaf9e40fae87e99e0ffe1153830195d08cff26311ce6 [VirusTotal]
ae74c18f5a03ff6645bdc264d45d2831120b9068c6be6e867da3d08cc319d5f0 [VirusTotal]
8169d6a6d8a02be8dcfcffcdfe5a93b7eb1191d8aac7146a53855dc8e5869913 [VirusTotal]
9b500839cfcdefff92257edb6e148d2d3860ab8453b5c8c0114ea0278bed5c96 [VirusTotal]

Known Malicious Remote Payloads

Select malicious OGF binaries listed above download a payload to trigger the osascript commands
These payloads change often and the list below is far from complete

bef42ce20a0a8954137c36a930adb40d452179729ba546e5baf0414234d3421a [VirusTotal]
efd545c5195bf73e3c7e7e54068c622d3961d56cd177c44bcd5721ee131df08a [VirusTotal]
e751591cf46159bb61a7b9237ef93ec181f9609d06fc0dc0522016d6c60e9629 [VirusTotal]
f6d411e35f29097b4873b662574f29cc0157ad1523400b88e49e81ad5cdaf595 [VirusTotal]
ea6e7458e4e72cd006fae9c40e9edf06272e0ea41fcc2d4cbcf4a1720bc13775 [VirusTotal]
0c95b2b99789ca29f0b3ce3674ecfd7a3fdca36ff57060e7c7a0cb10f120bcac [VirusTotal]
7e5751ca3b8a9a0e747fcab8665a5c98a73bd20214fdf23c8914cc81f6877fc7 [VirusTotal]
2ce574b3c03b2562b4f2303b5e7a4f262868913d01957689f2fdf40a3ab352f1 [VirusTotal]

Samples and Malicious Commands

See HERE for samples and detailed osascript command examples.

Edit
Pub: 27 Jan 2025 22:25 UTC
Edit: 21 Feb 2025 17:40 UTC
Views: 1206