{"id":97353,"date":"2023-03-09T23:33:33","date_gmt":"2023-03-10T07:33:33","guid":{"rendered":"https:\/\/www.intego.com\/mac-security-blog\/?p=97353"},"modified":"2024-04-18T03:10:51","modified_gmt":"2024-04-18T10:10:51","slug":"cryptojacking-mac-malware-honkbox-found-in-pirated-apps","status":"publish","type":"post","link":"https:\/\/www.intego.com\/mac-security-blog\/cryptojacking-mac-malware-honkbox-found-in-pirated-apps\/","title":{"rendered":"Cryptojacking Mac malware &#8220;Honkbox&#8221; found in pirated apps"},"content":{"rendered":"<p><img loading=\"lazy\" class=\"aligncenter size-full wp-image-97356\" src=\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2023\/03\/wooden-trojan-horse-600x350-1.jpg\" alt=\"\" width=\"600\" height=\"350\" \/><\/p>\n<p>Over the past couple weeks, multiple reports about cryptojacking and cryptocurrency-stealing Mac malware have surfaced. Apple calls this Trojan horse malware &#8220;Honkbox.&#8221;<\/p>\n<p>Let&#8217;s examine what we know about this malware, and how to safely remove it from infected systems.<\/p>\n<p><em>In this article:<\/em><\/p>\n<ul>\n<li><a href=\"#how-discovered\">What is Honkbox&#8217;s history, and how was it discovered?<\/a><\/li>\n<li><a href=\"#potential-harm\">What does Honkbox do to an infected computer?<\/a><\/li>\n<li><a href=\"#who-created\">Who created Honkbox malware?<\/a><\/li>\n<li><a href=\"#noteworthy\">What else is noteworthy about Honkbox malware?<\/a><\/li>\n<li><a href=\"#how-to-remove\">How can one remove or prevent Honkbox and other Mac malware?<\/a><\/li>\n<li><a href=\"#iocs\">Honkbox indicators of compromise (IoCs)<\/a><\/li>\n<li><a href=\"#other-names\">Is Honkbox known by any other names?<\/a><\/li>\n<li><a href=\"#learnmore\">How can I learn more?<\/a><a name=\"how-discovered\"><\/a><\/li>\n<\/ul>\n<h3>What is Honkbox&#8217;s history, and how was it discovered?<\/h3>\n<p>Early last year, on February 21, 2022, Trend Micro researcher Luis Magisa wrote what may have been the first public report about the malware that later became known as Honkbox. Magisa described the malware as the &#8220;latest Mac coinminer,&#8221; noting that it &#8220;utilizes open-source binaries and the I2P network&#8221; (more on that in a moment).<\/p>\n<p>On February 23, 2023, Jamf researchers published their own research, calling it &#8220;evasive cryptojacking malware&#8221; found in pirated Mac apps. According to their report, Jamf had been tracking recent developments of the malware family for a few months prior to publishing their research. Intego had also internally analyzed many Honkbox-related coin-miner malware samples months prior to Jamf&#8217;s write-up.<\/p>\n<p>New variants of this malware initially came on Jamf&#8217;s radar during routine threat hunting, when they noticed that a Trojanized version of Apple&#8217;s Final Cut Pro included XMRig, which is cross-platform cryptocurrency mining software. (As an aside, Intego has previously written about a <a href=\"https:\/\/www.intego.com\/mac-security-blog\/unwanted-cryptomining-debuts-briefly-in-mac-app-store\/\">PUA in the Mac App Store<\/a>\u00a0that utilized similar mining software, XMR-Stak, in violation of Apple&#8217;s policies.)<\/p>\n<p>The malware also employed Invisible Internet Project (I2P, or I2PD) technology (similar to <a href=\"https:\/\/www.intego.com\/mac-security-blog\/topic\/tor\/\">Tor<\/a>) to mask its bad network behavior, which included downloading payloads and sending any mined cryptocurrency to the malware maker. Notably, this is\u2014to our recollection, and that of other researchers\u2014likely the first Mac malware that has leveraged I2P. Both I2PD and XMRig are open-source utilities.<\/p>\n<p>Jamf&#8217;s research team was able to locate the malware sample in the wild via a mirror of The Pirate Bay, a BitTorrent file distribution site. The same user who had shared the pirated and Trojanized copy of Final Cut Pro had also been offering a number of other apps illegitimately since August 2019. Some of these Trojan horses have included Apple&#8217;s Logic Pro X, Adobe Photoshop, Adobe Illustrator, Adobe Zii (a product activator), Ableton Live, as well as CleanMyMac X. SentinelOne&#8217;s Phil Stokes points to a November 1, 2019 <a href=\"https:\/\/www.reddit.com\/r\/MacOSBeta\/comments\/dq39s6\/anyone_else_getting_comappleaccnetwork_requesting\/\" target=\"_blank\" rel=\"noopener\">Reddit post<\/a> as the first known public request for help from a Honkbox-infected user.<\/p>\n<p>Over time, the malware maker had found new ways of disguising its malicious behavior to better avoid detection by common antivirus software, such as the following example. Because crypto-mining takes a lot of processing power and can cause a computer to slow down significantly, the malware developer added a function to watch for the user to open Activity Monitor. Then, if the malware detected that Activity Monitor was open, it would instantly terminate the mining processes to prevent the user from figuring out what was causing the system slowdown. And, just in case the user were to use a third-party process monitor, the malware also disguised its processes in plain sight by naming them after legitimate Spotlight system processes, <code>mdworker_local<\/code>, <code>mdworker_shared<\/code>, and <code>mdworker_watchd<\/code>.<\/p>\n<p>Following Jamf&#8217;s report, Apple added signatures for this malware to <a href=\"https:\/\/www.intego.com\/mac-security-blog\/do-macs-need-antivirus-software\/#xprotect-applesmalwaredetectionengine\" target=\"_blank\" rel=\"noopener\">XProtect<\/a>, a bare-bones &#8220;anti-malware&#8221; feature built into macOS; Stokes noted that this was the first time in months (three months and twelve days, to be exact, between <a href=\"https:\/\/eclecticlight.co\/2022\/11\/10\/apple-has-pushed-updates-to-xprotect-and-xprotect-remediator-4\/\" target=\"_blank\" rel=\"noopener\">November 10<\/a> and <a href=\"https:\/\/eclecticlight.co\/2023\/02\/22\/apple-has-released-an-update-to-xprotect\/\" target=\"_blank\" rel=\"noopener\">February 22<\/a>) since the last time Apple had updated its signatures. (This, by the way, is just one reason <a href=\"https:\/\/www.intego.com\/mac-security-blog\/do-macs-need-antivirus-software\/\">why it&#8217;s so important to use Mac antivirus software<\/a>; Apple&#8217;s built-in protection is minimal, incomplete, and rarely updated.) While Trend Micro and Jamf hadn&#8217;t given the malware a unique name of its own, Apple first called it &#8220;<strong>HONKBOX<\/strong>&#8221; in its signatures, with three sub-variants: A, B, and C. Stokes did his own deep dive into the Honkbox malware, published on March 1.<a name=\"potential-harm\"><\/a><\/p>\n<h3>What does Honkbox do to an infected computer?<\/h3>\n<p>Honkbox malware is distributed via Trojanized, pirated software. Its primary purpose seems to be using victims&#8217; (pirates&#8217;) computers to mine for cryptocurrency on behalf on the malware maker. Cryptojacking\u2014that is, unauthorized use of a computing device to mine for cryptocurrency\u2014has a tendency to cause infected devices to slow down significantly. Cryptojacker malware may also cause devices to overheat.<\/p>\n<p>Early variants of Honkbox established persistence, meaning they could relaunch themselves after an infected Mac had restarted. More recent Honkbox variants are stealthier, opting to only reactivate when a victim opens (or attempts to use) the pirated software. The malware intentionally tries to hide itself by using Apple process names, and also by suspending its mining processes whenever the user opens Activity Monitor to try to figure out why their system is running slowly.<a name=\"who-created\"><\/a><\/p>\n<h3>Who created Honkbox malware?<\/h3>\n<p>The Pirate Bay user named &#8220;wtfisthat34698409672&#8221; is one known distributor of the malware. Given that Honkbox&#8217;s primary purpose appears to be cryptomining on behalf of the malware&#8217;s maker, it seems very likely that this user either is, or is a close associate of, the malware developer.<\/p>\n<p>Mac malware developers these days typically code-sign (and <a href=\"https:\/\/www.intego.com\/mac-security-blog\/topic\/notarization\/\">get Apple to notarize<\/a>) their malware to ensure that it will work properly on the latest versions of macOS. One Apple Developer ID that signed a variant of this malware used the name &#8220;Mucke N.S. Doo,&#8221; which is probably not a real name.<a name=\"noteworthy\"><\/a><\/p>\n<h3>What else is noteworthy about Honkbox malware?<\/h3>\n<p>In macOS Ventura, it&#8217;s more difficult for a maliciously modified (Trojanized) app to run. Many of the pirated apps will refuse to run on macOS Ventura, although the malware itself does successfully run. This should seem suspicious to the user, but by the time they realize they&#8217;ve been duped, the malware has already started running on their system.<\/p>\n<p>Users of macOS Ventura may see a dialog box similar to the following when a Trojanized app fails its code-signing check:<\/p>\n<blockquote><p>\u201cFinal Cut Pro\u201d is damaged and can\u2019t be opened. You should move it to the Trash.<\/p>\n<p>This file was downloaded on an unknown date.<\/p>\n<p>(Move to Trash) (Cancel)<\/p><\/blockquote>\n<p>Interestingly, the B and C variants do not install methods of persistence, meaning that the malware won&#8217;t automatically launch itself again after each reboot. Instead, the malware maker opted to make these variants run only when the user launches the Trojanized app. Due to the aforementioned changes in macOS Ventura, the malware will be active for much less time on Ventura than when run on previous macOS versions.<\/p>\n<p>The fact that macOS Ventura users have somewhat increased protection against harmful app modifications is one of many reasons why <a href=\"https:\/\/www.intego.com\/mac-security-blog\/apples-poor-patching-policies-potentially-make-users-security-and-privacy-precarious\/\">running the latest version of macOS is essential for your security<\/a>.<\/p>\n<p>As mentioned previously, Honkbox seems to be the first Mac malware to leverage I2P, the Invisible Internet Project, as a means of hiding its network traffic. Magisa noted that in years past, some previous Mac malware has utilized Tor (aka TOR, The Onion Router) for this purpose, including <a href=\"https:\/\/www.intego.com\/mac-security-blog\/mac-users-hit-by-rare-ransomware-attack-spread-via-transmission-bittorrent-app\/\">KeRanger<\/a> and <a href=\"https:\/\/www.intego.com\/mac-security-blog\/eleanor-is-dangerous-mac-malware-that-can-steal-data\/\">Eleanor<\/a> (2016) and <a href=\"https:\/\/www.intego.com\/mac-security-blog\/osxdok-can-read-encrypted-web-traffic-open-a-backdoor\/\">Dok<\/a> (2017).<a name=\"how-to-remove\"><\/a><\/p>\n<h3>How can one remove or prevent Honkbox and other Mac malware?<\/h3>\n<p><img loading=\"lazy\" class=\"alignright size-medium wp-image-54214\" src=\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2016\/06\/X9-Mac-Antivirus-Launch-300x150.png\" alt=\"Intego X9 software boxes\" width=\"200\" height=\"100\" srcset=\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2016\/06\/X9-Mac-Antivirus-Launch-300x150.png 300w, https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2016\/06\/X9-Mac-Antivirus-Launch-150x75.png 150w, https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2016\/06\/X9-Mac-Antivirus-Launch.png 600w\" sizes=\"(max-width: 200px) 100vw, 200px\" \/><\/p>\n<p>Intego VirusBarrier X9, included with <strong><a href=\"https:\/\/www.intego.com\/mac-protection-bundle\">Intego&#8217;s Mac Premium Bundle X9<\/a><\/strong>, can protect against, detect, and eliminate Mac malware. Intego software detects components of this threat under the names <strong>OSX\/Honkbox, <\/strong><strong>OSX\/CoinMiner<\/strong>, <strong>OSX\/Miner<\/strong>, and <strong>OSX\/Agent<\/strong>.<\/p>\n<p>If you believe your Mac may be infected, or to prevent future infections, it&#8217;s best to use antivirus software from a trusted Mac developer. VirusBarrier is award-winning antivirus software, designed by Mac security experts, that includes <a href=\"https:\/\/www.intego.com\/mac-security-blog\/why-your-antivirus-needs-real-time-scanning\/\">real-time protection<\/a>. It runs natively on a wide range of Mac hardware and operating systems, including the latest Apple silicon Macs running macOS Ventura.<\/p>\n<p>If you use a Windows PC, <a href=\"https:\/\/www.intego.com\/intego-antivirus\"><strong>Intego Antivirus for Windows<\/strong><\/a> can keep your computer protected from PC malware.<\/p>\n<p>In general, it&#8217;s always a good idea to avoid downloading software (or other potentially pirated content) from torrents. See our related article about how <a href=\"https:\/\/www.intego.com\/mac-security-blog\/why-bittorrent-sites-are-a-malware-cesspool\/\" target=\"_blank\" rel=\"noopener\">torrent sites are a malware cesspool<\/a>.<\/p>\n<p><span style=\"font-size: small;\">Note: Intego customers running VirusBarrier X8, X7, or X6 on older versions of Mac OS X are also protected from this threat. It is best to upgrade to the latest versions of VirusBarrier and macOS, if possible, to ensure your Mac gets all the latest security updates from Apple<\/span><span style=\"font-size: small;\">.<\/span><a name=\"iocs\"><\/a><\/p>\n<h3>Honkbox indicators of compromise (IoCs)<\/h3>\n<p>Magisa and Stokes note the following file paths associated with Honkbox malware. Note that the tilde (~) indicates a particular user&#8217;s home folder, for example <code>\/Users\/admin<\/code>.<\/p>\n<pre>~\/.i2pd\/tunnels.conf\r\n~\/.i2pd\/tunnels.d\r\n\/Library\/LaunchDaemons\/com.ableton.LiveEventd.plist\r\n\/Library\/LaunchDaemons\/com.apple.acc.installer.v1.plist\r\n\/private\/tmp\/com.apple.acc.installer.v1.plist\r\n\/private\/tmp\/i2pd\/._pid\r\n\/private\/tmp\/installv3_md5\r\n\/private\/tmp\/installv3.sh\r\n\/private\/tmp\/lauth\r\n\/usr\/local\/bin\/com.apple.acc.installer.v1\r\n\/usr\/local\/bin\/com.adobe.acc.localhost\r\n\/usr\/local\/bin\/com.adobe.acc.network\r\n\/usr\/local\/bin\/liveeventd\r\n\/usr\/local\/bin\/liveeventd.sh\r\n\/usr\/local\/bin\/livelocalserviced<\/pre>\n<p>Files with the following 177 hashes have been identified as affiliated with Honkbox-related malware campaigns:<\/p>\n<pre>0054a66081cc686b1980cbbcf8f4c2b792fa7d50aa986baa79a367c57cbe7c96\r\n02b3c088f88f908e1c69d88cd9427087e3b256a0654a83eb8141437ba7f052ab\r\n035b75295e8b7286c2bd9c04f53a51708b4cb7fe3825787778244de4d437a8ae\r\n04d8a419e1bf634e0247efbc6308a5a8355531044a2c76be09857d0d6fafaafa\r\n066bf1e7137fa1e0733fee274fdf7480cdf5ff8cfceb0164047dc8ee91a15a00\r\n0b15645b227245e4f5baf53a4e6899f8bbfd42ce2c53a7fea83a746d12411006\r\n0b9a3b00302faf3297b60fff0714f2db87245a613dcd9849645bffa7c4a3df9b\r\n0c3f47c4877d1f4079c4aa850b28a3780728a6ca94b6d3f7385ecd5df4dc9e42\r\n0d0e8e3316db0e1ed3d0fab331cff9a67bfb18fd17e0210042edd3823136b6f1\r\n0e41d3e3b464f3fb8c140340e6a85a376c6c17499dd6bbf7de5940d401b9e71a\r\n115316f7a3a1e25643dc0a837ae5fd0abf36cd5f61b03f0074e72d8c0d148bfe\r\n1153b5abea8d93b45a4a4bf704e2138fca50d034a4bf440147eed8516cd4bf2d\r\n12f416e67d9cd74ec3488842b9bf61092f35c0ae4de467afaebba2cb3933fc26\r\n1326f82c76c7007f5243d2bb7c458fcda359807e6ca26b71f1196604b2f30176\r\n1ba39220d81bc327b13be4c2b788c79ae51a2db9a890c336701f8724cdf01538\r\n1c34442c74b6f31c522c2901b364a8052d48031ad75b95f026c64e372a4fce3d\r\n2272273f8cc692968a885d5d974e6658400fefdbedb03f061a61bd6839f963cc\r\n24ace87331051d7d2d83bb9a89781847f47b4c00789c19b5385fce94705c3c40\r\n257a431cc27a8aa65f5ce23eaba320dae1780640ad1012ff70c60f2f6efdf2b3\r\n25e13d453ce5ed969beba9c63cf04fa9e1f4bdd762cdaa3ca5b47c40ae4e22d6\r\n27158886ab064880aa5d5196248f2ad4b20b38bbb1321f72bca17351165ea3e5\r\n2729644adea3bc14f6654d2c461cc29a6751216ce79442b6a17d90fe093235c3\r\n28d2825b7ee97c8f6a1c6acac6fa6de28f35b10781abee65321ba0f53f9d401f\r\n297f7887723509e999ed9c0635fbc70d7806e0928ccd4ed993a8c0bd2f0a0d1d\r\n2af033ab24ec9d11729efb465aad8843d1ec0eb6c248967456adc83db7407251\r\n2bd0400003bf577336a73d56ffa3aacf8902be557fddadb5425fb114ca180d9b\r\n2ce3bea5646f9b66d407402d4891c7866d4dc3583809f4d669eda0c72a34e44d\r\n2d604cf677b05ef1c0d1ee0758f33e8bbb4a2b1e5e9385c32ec388ddd19f5ebc\r\n2d71c31260ffb8199b09c20a875baeed7192a84352c4cdd3a9e9c550735c7763\r\n2f77fe48e97b7a81108eda70e4129f9dc8118fac99dff71ab7a998b6d45b55c0\r\n3028436248053280a93c3bedbefa65cacaf6e805e98a9bde09d858db974aab09\r\n317264e44dd520d6af53f6d3bcd0e2b2b9e595f59255d315a3a4244f069b7dd1\r\n33114dd11009871fa6ad54797b45874d310eed2ad2f1da797f774701363be054\r\n33a6c6a1b8cb3e8d5e3b06d75e5905f4a8628eae7382db488d9060ad06f4f28b\r\n357c473cb0c1eb3fd228b0a8dc51fe3c29f862c5e1c497727f8274fce5bd822f\r\n363f0367ab91805114cfe194b70bf75c983e3d1ec4aacec7dfa9c7aa3e375f05\r\n378bd56fda7da307ff46480db9593bc5766e58668d200336074b30f7ccab90b3\r\n38b45ef33a777dd911f1d74ea4068f1cb128674359083c3b0be585de3edbd3ac\r\n3ca56e4330e1adb2c537105fb8ebcb2b540e8d83c3f3d7e09dd5e46f8fde2e7b\r\n40c095d178179e9ee2fd43aa9644bcfaa49b21b9dfa27fd7cf1f73eaa7a6de65\r\n416997b3db74871a6875bf06d44fa40053a37d465113592a4cc2ca2e05ead135\r\n42323779c82716566c979f248262a801c9a684e183be51e5aeeb124168373ee3\r\n42f982cde3d7aa9c5b86abe6c94119f7e4351fe84fe5ede41a1f1f2e0ab45be0\r\n47e254aa7feb62a0633ed2a1806046cf3134c1277684a1fc8ea2e3dd6caa3795\r\n4f81a3be98daf39ff27d3db7f9d9155ba564f7ad8f5e7f22600ad2326b29d8d6\r\n51fa2a1a1b169eaf51c473ea5d70bb1900db85cb2d8734913ec7f918a25e3f11\r\n5585da2d7c24727714cf7521e078a8571fe8d33d3b547bb3b527db2ad40a7fdf\r\n55a095ff66a42f9039007c79edb989be253e96fb451a97115d2eb20ee6276a5c\r\n55e67f84da909a422033ad25df92a53fb1255c29b4baaf7c84b43429f07a1909\r\n58bd46dfb06afddbc22d0ef49c47c0786d7d98e93c7db1160f5bd49a7fa2147c\r\n5c3d0bbb99e120adf610537fbaf6f2ba28d7e64b69ce7229bc0a95986d41a49b\r\n5daa833fbea1ae715a3fc2d73702538d3fe0f119763427c404102deff7385f58\r\n5eb458be93f0580033277668346a0186b8a275d0a375bae32bef377dc1b4f229\r\n5eed44c7c5b7e909234db83526d2f5bfa5dfcdeaaf25543fa2254ba5f06b4c71\r\n5efac1774453cb2085ab37ae273a2b678ec96e8d955f5c9508ececf10e99cbb2\r\n5f951439f639b2373c83c30f6375978d0bd43a9ea0088ecd8b8c92cb6875e0cb\r\n5fc9cf36d323a7bdb097c2810c8e420fa203ca2e4b2767a0a975455960be10b5\r\n60b34b8bf921b0e1eefc728413e1fb8c22afde5065e6a1b5e0a61a2e254074d8\r\n61c2ff0533bc92b409d135aab64e79390a6fa3f8307bee5ecec1f243c85521f1\r\n61e43aafdfe722d60411993406c8f6bcc4ce313ff55e2da0961fe64d835b66fd\r\n68fbd79ab1ee9abfffc998429c9fb626f3a94e531f14a3d4176673f1708d2e36\r\n69f18b2abd0a213c5e1e18c6de2fc299f6e997c4988847bdf74918438fcc5ad4\r\n71135661f2993363083768c8d1cb070bbdd9299f57b4d06197ebfc2c534847ce\r\n731cf0317f409c5e23411efccc94fe8ebd897f625da300ccb98ad7ff4a12741c\r\n738c7536ff7dbd95161517658f5438b5f9633ce9baef423a629ea7057a1e0c1b\r\n7468232b6d3c4ca9555fe3be5d1a4d4764c57c41a7a78a8ceb71f2c5189abb74\r\n7606c10c2cfdf9aabd81306a2805d0f1e41ef63a6809ef1f7d7913d1dfa21039\r\n7be2a727d19c12b1bc07684f242214e5be3504db8d975aeec3d6f6f41c20897a\r\n805669554e529381ac8c113e54932151dc3c2ef14fcb3bac47ebebaa62d2b108\r\n810bb73988dc47558b220047534d6dab9a55632c1defa40a761543ebaaa2f02c\r\n82633f6fec78560d657f6eda76d11a57c5747030847b3bc14766cec7d33d42be\r\n845ef90acc34abfce89e3e630265f23c03581918d30256c9e3c3d65250464933\r\n8507e76362664fe2ed9c9407e237fed900881472abd5fbbaf88d772268836031\r\n85bc3d47a36469146f38a58f4d282b71acb16063600a58e3feb0fece933ae860\r\n8604a10bd97099e8e5539eff05c49bc518a774bf8e7c4ef6c36d902f7fdaeb6e\r\n8639d8928024c4b7786895660426431a987353d505472074575ff2c50edb9752\r\n8683f22a045b53bf32cedd8ca815f784682903459d7991f9008aed5d9452a4d6\r\n8a41a5633a485be7da1ae9430eca5bd94c0b1f3d21b39415e71024c78b31ec85\r\n8bf8227574aa06838b00bf437bba47a6189f9606d21ee91838f9e8aceed8121a\r\n8d78cf74f0ae3626443a78ae750c2cbf8659b1556e653fdecb769149d7637f17\r\n9104cd6bb30916ed9b4f1ebb213cc030e8bb5667b69b823979b5d2b4dd146e31\r\n9403c3eaee3a0d1f32e3909ce3030d8349c71f35dc78c4508fe7a44c4e55894f\r\n950b8f52e2c62a9165f9d07abc8caaf45be12d1d059b984e344637f4f808262a\r\n9518906dc416de6c6a5d17479244cf698b062c1d6b4425d86ee6895ce66c7c39\r\n95756b979d11c7b8f80a952d9b64de1ccce2da256f8ebe639a804a2c2ff66065\r\n9a8ed6ebec5d0a79e0aad8fdb229f3baa42701d87104f0f94a6bd9527797061c\r\n9bfee899de10e0bafa3aeb3e0ee554a42de8e3a9a176e8fae5de49aaca6c2541\r\n9c18f0fe4b87bd9c595a5374e3ed670a93e567b584b6a3592b18051a1793c2ab\r\na22b48ce098ad4b082c4f4de78c708294e08212ab8dfd818642f7922c8e794c3\r\na2909754783bb5c4fd6955bcebc356e9d6eda94f298ed3e66c7e13511275fbc4\r\na2c6d699834eb992b11778a8d4595e2563b2ffa9d631936baaa0c0e29c504760\r\na52c06bcc1f4289013f01489da82b453e687a74af13e59077565a614494ea435\r\na5b10a483369a040f9638bdbf0329a279bc161c617828844e8a9be7bec959b03\r\na892c8e0fa01f32ad96ccdf9b9a7fbbe65b7301b0cf8cf99add2eef0eefb4277\r\na92ca3b2e8a4f9a793e2499c5fb4ff1696936f12117f6fe2233786a04d21e107\r\nac5b06b7db12c0392d3adc1838e307ab0c9b14c89e596cad1b6d47a9e4aee18f\r\nadf7c5d9298cad65c66b21d801b37ca416361dbecb5d8ab91a294c4223272dff\r\nae4abadd15e854c0a2c5e6c8180d567f37c1c97adc4520494ea0f15323c764df\r\nae66f7568a0f724eaa850cf7f405bdcc2ac15062d50380a30db553b21ef535c9\r\nb1a11ef27ca5822f89400145f9c726b03fb7328d18f57d5d676fa2ff31eb17c1\r\nb1fff5d501e552b535639aedaf4e5c7709b8405a9f063afcff3d6bbccffec725\r\nb2e135c6c6c3851599b436c172f84a301ad9646f7f4a4ac6c268c135925cd538\r\nb350c864eb3d896d3b3b0a9992f79b6a4acf1f565e2fe612af8b172253573c58\r\nb949d5246370280cac93db9cfe9587b25c7e1e5df5cd955ba647708a7c0e474f\r\nba81cca31a45f01b9ae6bf704b7af7c26fb3e882cfeca1264f79ac276e3ee783\r\nbd8f4523409538759df622d0fc9105e732d3b8becfe4bb84a9a0c1bd920ac12d\r\nbe1bb6d2b1e327aa80ac75d85632f04293b8402d27440e18f2233640962e1a4a\r\nbfa9f7b8014efab4143fb2a77732257144f3b804ee757fb41c9971b715da53d7\r\nbfea3de39cf1d872c6616222b567c92d9bc78b4fb3bda94e1274b75693a8398f\r\nc0c4826e513239094c63382b5a726e056ae7f7759abc56bf807748ecfbfbb284\r\nc4c4f074d4a6e7f10162d18105f564741e39e939b25c6af22e9f4c24746d7d1c\r\nc5d7ee587e364b28a8b625c33b2a0ac55c7b48b865217de17235551e242314d4\r\ncbad9d6fd5b7d2e8860735e02f3bc54b9fc0d044df508f2293a60f2741ed7a66\r\ncc483d9aa67048f7249f970337e329280b5ceb05053796ea44476e153e392686\r\nce6c16fbbdc0971c19255d5e865d67e729492891808e80c9001e91872cd78885\r\nceb3a83a99bed19916bf941466d6ace86d4cbab333feb70908dcd5a59e1ccc74\r\nd33a59e09b1747998e9276f1ef8067cf3c401acf1ecc05e979bb60c3531d7b7e\r\nd4813760fb9b79d811132044628b61d5fc5b0a58dd31f0d183e40180c184a0a9\r\nd481689c0d11c00a34812516b79316b25139b5c1ef11855b36c0a9ea89d19efd\r\nd7ec99f0d019f476f82341dba3c2af10f71628f9ab664d05ab007fe420e0cdb1\r\ne72ac7d99fa1f7c43b88058df8396965b4fa7089264a51950c94d53efb297558\r\ne97758623aea98e0733b43666b5f112e40edac7ee1f9a916ca83581e0187abae\r\ne9e2b8684c966d65e4b0d3db7956344b0291c99b2473a4384d4a4e59a6f052c2\r\nea28251de6a09d19f8cff7fe366c35d3826c10544a3a45426369aaf9e4b2050d\r\nec606d39fdf5359af96e40cfc1f226b70e7ee2ff68925eb7ad71f20c395dbab1\r\nee0a287d2923c57ac96e30f0da015f1e01c93c5c806aeb91e680c56aa6df1266\r\nf24da6301f95432a63eb98f8954e1da6f7275b73d0bde76052d66a6d2e587df5\r\nf5e57974a654c196e62e23d9282b21d5e41c8fbb0dd3a072316d4f3da3b1b5ba\r\nf6c55df67f126d39424c087cd359d7cb30a796b637b8a2fb9f409c9c98fcde7d\r\nf7106ee5c184bd764b94faba0d926fce48654320456fd7fd30751c56bd9f707b\r\nfa63f4b05c71e8f02275b590a560c24740ca88268a1a62cd80a9174e188f484f\r\nfaabe528449d14515ae25c8a8e5abd7d76e6b9acf25635929dea031e30db831c\r\nfabe0b41fb5bce6bda8812197ffd74571fc9e8a5a51767bcceef37458e809c5c\r\nfcc902dd3ae5a1413607c3493617f33a4b2dbf03f861c18afc32821b8d47da81\r\nfd947019a2b3269d5ba1fb7a1314e4030cfd2f3dbb3049b4f7495f7966a493c4\r\nfe3700a52e86e250a9f38b7a5a48397196e7832fd848a7da3cc02fe52f49cdcf\r\nffc8cc1badc17c408b5e0e7045abbefa05ac2200c057997136880a8695f5656c\r\n048a93a696f1bf0bdf6f6e3506d65d21a4a9f681\r\n05b7e1864b7b570a339c8072830cdd9bcbf21d1a\r\n0cc8e03a08baa73379ac6c55cbb18fa78b87923d\r\n0e73071ceb9d2481361777b33b8443ec0acb0793\r\n11e4f795551e6db0fe9a9c52eec35f134b089478\r\n11ee7a59ecd287628ff251b435777f6d4429e40c\r\n140790186d0c60a604c5dd9f9d2c8dbc500da1c9\r\n163d9ce53deadd54ad50d7d0120b5db550724689\r\n33d79b8ee94f7bd0a542863cd5a8926d8e0263d9\r\n3a714063188b24f0392c163d7910be00216a5f04\r\n4f0ba59e2ee80ff854bca33944f825d4c8cfe23e\r\n5aae6e00b3ab0b32a8c75a2952674d7665b3f705\r\n5eb0e95aa6cc68ec05103561b02d38d4f69e4980\r\n62ed66c1835ef5558ce713467f837efde508d5e4\r\n699da2b8d35f344121d93a74adf89349d3c8d922\r\n6b987ffc3fd6a2bcfb931426be4118cd943737da\r\n7312b319b84be6bde845b10ea61619c33473f784\r\n7da20852d79f7443b88449e8ed18e092c2aaa3bb\r\n828fb69b80e60de6f6206fd63b496cc0923082f4\r\n8e4dff96e1740764d60fbff8cfae8c673f1a7a3f\r\n901a08aa9996fa95e4a844c24eb7b81da0b52923\r\n90835a1173e9ed414e8240d0e14acb13f73f642f\r\n9e04ca30e6ae20e8d2bbf2772a93145bd4b5b8c6\r\n9e387d79fd6412715a5a4bca02b7e27a08299c4b\r\na72b548ca570d8c74ed4c465716c4e37328f9bc1\r\nb48927641b53e363d7183fe7faaaa7be8b01cec9\r\nb5dd15e765ed5839a7d2c16c50e6cf3334c4b894\r\nbe30f974111ad50312f654db9e040c6ab99d054c\r\nc3d062bc3fa3b4ecfc68e69a7dc26d9e0ac56538\r\nc5b34662f22f35f3995144b24015309bbe318cd9\r\nc64c21d2e08cb8a28e31c4d883a1e75fd1c7851b\r\nc8d230830d0912236c48c31ad11b93707088ce9f\r\ncc9afb9efea37aee31cd74fb064de4b732fb84b3\r\nd4d1c97c5803162e452c79811d61e1487c9cfe62\r\ndfcf0b6af4593f32060176768164702f45cb556b\r\ne857a9c520402ccc6abe3244c1e93ac9e2a6ac3d\r\neb3a1808bd24026314bec69caadbc882f1976982\r\nebd417f4ab9e7bb6deaacab9de1611df67908317\r\necffd9553c67478a55f7303f6cadf356101f9216\r\nf35bddfbb82ae1b137cbd454bc18f2b859cc5882<\/pre>\n<p>Note that the first 137 file hashes listed above are SHA-256 hashes; the corresponding files are all available to security researchers via <a href=\"https:\/\/www.virustotal.com\/\" target=\"_blank\" rel=\"noopener\">VirusTotal<\/a>, except for one from Magisa&#8217;s report, namely <code>c0c4826e513239094c63382b5a726e056ae7f7759abc56bf807748ecfbfbb284<\/code>. The next batch of 40 shorter SHA-1 hashes were included in Jamf&#8217;s write-up but were not available on VirusTotal at the time of this blog post&#8217;s publication.<\/p>\n<p>Apple Developer IDs including the following have been used as part of this campaign:<\/p>\n<pre>MUCKE N.S. DOO (XFQL4XQZYW)\r\nF2P859A6Z6<\/pre>\n<p>Command-and-control (C&amp;C) domains and IP addresses that have been associated with related malware include:<\/p>\n<pre>banana.incognet[.]io\r\ndownload.xxlspeed[.]com\r\ni2p.mooo[.]com\r\ni2p.novg[.]net\r\ni2pseed.creativecowpat[.]net\r\nnetdb.i2p2[.]no\r\nreseed-fr.i2pd[.]xyz\r\nreseed.diva[.]exchange\r\nreseed.i2p-projekt[.]de\r\nreseed.i2pgit[.]org\r\nreseed.memcpy[.]io\r\nreseed.onion[.]im\r\nreseed2.i2p[.]net\r\nthepureland[.]io\r\n162.55.188[.]117\r\n167.235.233[.]5\r\n193.168.141[.]107<\/pre>\n<p>A number of Dropbox URLs have reportedly hosted related Mac malware; these URLs are no longer active:<\/p>\n<pre>www.dropbox[.]com\/s\/1qo9cozv8srnx2x\/PureLand%20Launcher.pkg?dl=1\r\nwww.dropbox[.]com\/s\/37vvqyjx6qi43ex\/PureLand%20Launcher.pkg?dl=1\r\nwww.dropbox[.]com\/s\/3yivn8j36ramnvg\/Pure%20Land%20Launcher.pkg?dl=1\r\nwww.dropbox[.]com\/s\/tmfj1iemicvu6t0\/PureLand%20Launcher.pkg?dl=1<\/pre>\n<p>Network administrators can check recent network traffic logs to try to identify whether any computers on their network may have attempted to contact these domains, IPs, or URLs, which could indicate a possible infection.<a name=\"other-names\"><\/a><\/p>\n<h3>Is Honkbox known by any other names?<\/h3>\n<p>Prior to Apple giving it the name Honkbox, this malware was mostly known by generic &#8220;CoinMiner&#8221; or &#8220;Miner&#8221; monikers.<\/p>\n<p>While investigating other recent malware campaigns, our malware research team observed that a cryptocurrency stealer malware family that&#8217;s being called <strong>PureLand<\/strong> (or Vakksdr Stealer) matched our existing signatures for Honkbox. Therefore we have realigned our detection and consider these recent PureLand samples to be part of the Honkbox family. The lists of SHA-256 hashes, domains, IPs, and URLs above includes some related to PureLand. (Stokes initially <a href=\"https:\/\/twitter.com\/philofishal\/status\/1634166802962870274\" target=\"_blank\" rel=\"noopener\">connected Honkbox and PureLand<\/a> as well, but <a href=\"https:\/\/twitter.com\/philofishal\/status\/1634166802962870274\" target=\"_blank\" rel=\"noopener\">later backtracked<\/a> after Intego published this report, so this possible relationship between the PureLand and Honkbox families is disputed.)<\/p>\n<p>Other vendors&#8217; names for threat components related to this malware campaign may include variations of the following, among others:<\/p>\n<p><span style=\"font-size: small;\">A Variant Of OSX\/CoinMiner.AC, A Variant Of OSX\/CoinMiner.AD, A Variant Of OSX\/CoinMiner.Q, A Variant Of OSX\/CoinMiner.W, Application.MAC.Miner.AJB, Coinminer.MacOS.MALXMR.H, Gen:Variant.Trojan.MAC.PureLand.1 (2x), HackTool.XMRMiner!1.ADCC (CLASSIC), HEUR:Trojan-Dropper.OSX.Agent.gen, HEUR:Trojan-Dropper.OSX.Agent.m, HEUR:Trojan-Dropper.OSX.Padzer.e, HEUR:Trojan-Dropper.OSX.Padzer.f, HEUR:Trojan-PSW.OSX.Pureland.gen, Honkbox_A, Honkbox_B, Honkbox_C, MacOS:Agent-JM [Trj], MacOS:Agent-JQ [Trj], MacOS:Agent-WN [Drp], MacOS:Agent-XI [Trj], MACOS.HONKBOX.A, MACOS.HONKBOX.B, MACOS.HONKBOX.C, MacOS\/CoinMiner.A, Malware.MacOS-Script.Save.e4825366, Malware.OSX\/Agent.ctche, Malware.OSX\/Agent.jfggl, Malware.OSX\/Agent.zobat, Multios.Coinminer.Miner-6781728-2, OSX_CoinMiner.PFL, OSX.Trojan.Agent.5V7AH3, Osx.Trojan.Coinminer.Bgow, OSX.Trojan.Gen.2, OSX\/Agent.CJ, OSX\/Agent.G!tr, OSX\/Agent.gixtd, OSX\/Agent.wguen, OSX\/CoinMine-BU, OSX\/CoinMine-CS, OSX\/CoinMiner.bdmlu, OSX\/CoinMiner.ext, OSX\/CoinMiner.pjtut, OSX\/CoinMiner.qfokr, OSX\/Honkbox.ext, OSX\/Miner.AC!tr, OSX\/Miner.gen, OSX\/Miner.qt, OSX\/Miner.shell, Other:Malware-gen [Trj], Password-Stealer (0040f1771), PUA.MacOS.PURPLEPROXY.MANP, PUA.MacOS.PURPLEPROXY.MSGEM20, RDN\/Generic.osx, Riskware\/Application!OSX, Script.Trojan.A7586096, TROJ_FRS.0NA103BM22, TROJ_FRS.0NA104A223, Trojan (0040f28a1), Trojan:MacOS\/Multiverze, Trojan:MacOS\/SAgent!MTB, trojan:OSX\/Honkbox.ext, trojan:OSX\/PureLand.ext, Trojan.CoinMiner.OSX.44, Trojan.Generic.D3056588, Trojan.Generic.D3EB7491, Trojan.GenericKD.50685320, Trojan.GenericKD.65762449, Trojan.I2pdMiner\/OSX!1.D989, Trojan.MAC.Generic.111680, Trojan.MAC.Generic.111683, Trojan.MAC.Generic.111728, Trojan.MAC.Generic.111730, Trojan.MAC.Generic.11970, Trojan.MAC.Generic.D1B440, Trojan.MAC.Generic.D1B443, Trojan.MAC.Generic.D1B470, Trojan.MAC.Generic.D2EC2, Trojan.MAC.Miner.AF, Trojan.MAC.Miner.AS, Trojan.MAC.Miner.AT, Trojan.MacOS.PADZER.MANP, Trojan.MacOS.PADZER.MSMEK20, Trojan.MacOS.PADZER.MSMH321, Trojan.MacOS.PADZER.RSMSMEL20, Trojan.Malware.121218.susgen, Trojan.OSX.Agent.4!c, Trojan.OSX.Coinminer, Trojan.OSX.Generic.4!c, Trojan.Shell.Agent.cp, Trojan.Shell.Agent.CQ, Trojan.Win32.SHELL.VSNW05C23, Trojan\/Bash.Generic.SC186845, Trojan\/OSX.CoinMiner<\/span><a name=\"learnmore\"><\/a><\/p>\n<h3>How can I learn more?<\/h3>\n<p>For additional technical information about the Honkbox malware, including reverse-engineering analyses, you can refer to the detailed write-ups by <a href=\"https:\/\/www.trendmicro.com\/en_us\/research\/22\/b\/latest-mac-coinminer-utilizes-open-source-binaries-and-the-i2p-network.html\" target=\"_blank\" rel=\"noopener nofollow\">Luis Magisa of Trend Micro<\/a>, <a href=\"https:\/\/www.jamf.com\/blog\/cryptojacking-macos-malware-discovered-by-jamf-threat-labs\/\" target=\"_blank\" rel=\"noopener nofollow\">Matt Benyo, Ferdous Saljooki, and Jaron Bradley of Jamf<\/a> and <a href=\"https:\/\/www.sentinelone.com\/blog\/hunting-for-honkbox-multistage-macos-cryptominer-may-still-be-hiding\/\" target=\"_blank\" rel=\"noopener nofollow\">Phil Stokes of SentinelOne<\/a>. See also Stokes&#8217; follow-up <a href=\"https:\/\/twitter.com\/philofishal\/status\/1633404680603594753\" target=\"_blank\" rel=\"noopener\">tweets<\/a>. We also acknowledge the research into PureLand from Daniel Stinson (see his <a href=\"https:\/\/twitter.com\/shellcromancer\/status\/1632238157767888898\" target=\"_blank\" rel=\"noopener\">tweet thread<\/a> and <a href=\"https:\/\/gist.github.com\/shellcromancer\/64facf7ad1b4c104cb3d0550f4bd2ab5\" target=\"_blank\" rel=\"noopener\">hash list<\/a>) and iamdeadlyz (see their <a href=\"https:\/\/twitter.com\/Iamdeadlyz\/status\/1633253641556746240\" target=\"_blank\" rel=\"noopener\">tweet thread<\/a> and <a href=\"https:\/\/iamdeadlyz.medium.com\/pureland-a-fake-project-related-to-the-sandbox-malspam-13b9abe751d1\" target=\"_blank\" rel=\"noopener\">write-up<\/a>).<\/p>\n<p>We briefly discussed Honkbox on <a href=\"https:\/\/podcast.intego.com\/281\">episode 281<\/a>\u00a0of the Intego Mac Podcast:<\/p>\n<p><iframe loading=\"lazy\" src=\"https:\/\/player.fireside.fm\/v2\/GegHgcrH+bxAb4Vzm?theme=dark\" width=\"740\" height=\"200\" frameborder=\"0\" scrolling=\"no\"><\/iframe><\/p>\n<p>Each week on the <a href=\"https:\/\/podcast.intego.com\/\" target=\"_blank\" rel=\"noopener\"><strong>Intego Mac Podcast<\/strong><\/a>, Intego&#8217;s Mac security experts discuss the latest Apple news, including security and privacy stories, and offer practical advice on getting the most out of your Apple devices. Be sure to <a href=\"https:\/\/podcasts.apple.com\/us\/podcast\/intego-mac-podcast\/id1293834627\" rel=\"noopener\"><strong>follow the podcast<\/strong><\/a> to make sure you don\u2019t miss any episodes.<\/p>\n<p>You can also subscribe to our <a href=\"https:\/\/www.intego.com\/mac-security-blog\/mac-security-newsletter\/\"><strong>e-mail newsletter<\/strong><\/a> and keep an eye here on <a href=\"https:\/\/www.intego.com\/mac-security-blog\"><strong>The Mac Security Blog<\/strong><\/a> for the latest Apple security and privacy news. And don&#8217;t forget to follow Intego on your favorite social media channels: <a href=\"https:\/\/twitter.com\/IntegoSecurity\" target=\"_blank\" rel=\"noopener\"><img style=\"border-width: 1px; border-style: solid; border-color: rgba(255, 255, 255, 0.2); border-radius: 8px;\" title=\"Follow Intego on Twitter\" src=\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2021\/10\/Twitter-logo-icon-64.png\" alt=\"Follow Intego on Twitter\" width=\"16\" \/><\/a>\u00a0<a href=\"https:\/\/www.facebook.com\/Intego\" target=\"_blank\" rel=\"noopener\"><img style=\"border-width: 1px; border-style: solid; border-color: rgba(255, 255, 255, 0.2); border-radius: 8px;\" title=\"Follow Intego on Facebook\" src=\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2021\/10\/Facebook-logo-icon-64.png\" alt=\"Follow Intego on Facebook\" width=\"16\" \/><\/a>\u00a0<a href=\"https:\/\/www.youtube.com\/user\/IntegoVideo?sub_confirmation=1\" target=\"_blank\" rel=\"noopener\"><img style=\"border-width: 1px; border-style: solid; border-color: rgba(0, 0, 0, 0.2); border-radius: 8px;\" title=\"Follow Intego on YouTube\" src=\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2021\/10\/YouTube-logo-icon-64.png\" alt=\"Follow Intego on YouTube\" width=\"16\" \/><\/a>\u00a0<a href=\"https:\/\/www.pinterest.com\/intego\/\" target=\"_blank\" rel=\"noopener\"><img style=\"border-width: 1px; border-style: solid; border-color: rgba(0, 0, 0, 0.2); border-radius: 8px;\" title=\"Follow Intego on Pinterest\" src=\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2021\/10\/Pinterest-logo-icon-64.png\" alt=\"Follow Intego on Pinterest\" width=\"16\" \/><\/a>\u00a0<a href=\"https:\/\/www.linkedin.com\/company\/intego\" target=\"_blank\" rel=\"noopener\"><img style=\"border-width: 1px; border-style: solid; border-color: rgba(255, 255, 255, 0.2); border-radius: 8px;\" title=\"Follow Intego on LinkedIn\" src=\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2021\/10\/LinkedIn-logo-icon-64.png\" alt=\"Follow Intego on LinkedIn\" width=\"16\" \/><\/a>\u00a0<a href=\"https:\/\/www.instagram.com\/intego_security\/\" target=\"_blank\" rel=\"noopener\"><img style=\"border-width: 1px; border-style: solid; border-color: rgba(255, 255, 255, 0.2); border-radius: 8px;\" title=\"Follow Intego on Instagram\" src=\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2021\/10\/Instagram-logo-icon-64.png\" alt=\"Follow Intego on Instagram\" width=\"16\" \/><\/a>\u00a0<a href=\"https:\/\/podcasts.apple.com\/us\/podcast\/intego-mac-podcast\/id1293834627\" target=\"_blank\" rel=\"noopener\"><img style=\"border-width: 1px; border-style: solid; border-color: rgba(255, 255, 255, 0.2); border-radius: 8px;\" title=\"Follow the Intego Mac Podcast on Apple Podcasts\" src=\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2017\/10\/ios9-podcasts-app-tile.png\" alt=\"Follow the Intego Mac Podcast on Apple Podcasts\" width=\"16\" \/><\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Honkbox, a cryptojacking Mac malware family, has been distributed via Trojanized software found on The Pirate Bay. Here is everything you need to know to protect yourself from this threat.<\/p>\n","protected":false},"author":14,"featured_media":97354,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"spay_email":"","jetpack_publicize_message":"","jetpack_is_tweetstorm":false},"categories":[190],"tags":[4162,4156,3982,4722],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v17.4 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<meta name=\"description\" content=\"Honkbox, a cryptojacking Mac malware family, has been distributed via Trojanized software found on The Pirate Bay. Here is everything you need to know to protect yourself from this threat.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.intego.com\/mac-security-blog\/cryptojacking-mac-malware-honkbox-found-in-pirated-apps\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Cryptojacking Mac malware &quot;Honkbox&quot; found in pirated apps - The Mac Security Blog\" \/>\n<meta property=\"og:description\" content=\"Honkbox, a cryptojacking Mac malware family, has been distributed via Trojanized software found on The Pirate Bay. Here is everything you need to know to protect yourself from this threat.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.intego.com\/mac-security-blog\/cryptojacking-mac-malware-honkbox-found-in-pirated-apps\/\" \/>\n<meta property=\"og:site_name\" content=\"The Mac Security Blog\" \/>\n<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/JoshLong\" \/>\n<meta property=\"article:published_time\" content=\"2023-03-10T07:33:33+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-04-18T10:10:51+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2023\/03\/wooden-trojan-horse-400x260-1.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"400\" \/>\n\t<meta property=\"og:image:height\" content=\"260\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@theJoshMeister\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Joshua Long\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"12 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#organization\",\"name\":\"Intego\",\"url\":\"https:\/\/www.intego.com\/mac-security-blog\/\",\"sameAs\":[],\"logo\":{\"@type\":\"ImageObject\",\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#logo\",\"inLanguage\":\"en-US\",\"url\":\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2022\/10\/intego-organization-logo-for-google-knowledge-graph-875x875-1.png\",\"contentUrl\":\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2022\/10\/intego-organization-logo-for-google-knowledge-graph-875x875-1.png\",\"width\":875,\"height\":875,\"caption\":\"Intego\"},\"image\":{\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#logo\"}},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#website\",\"url\":\"https:\/\/www.intego.com\/mac-security-blog\/\",\"name\":\"The Mac Security Blog\",\"description\":\"Keep Macs safe from the dangers of the Internet\",\"publisher\":{\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.intego.com\/mac-security-blog\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"ImageObject\",\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/cryptojacking-mac-malware-honkbox-found-in-pirated-apps\/#primaryimage\",\"inLanguage\":\"en-US\",\"url\":\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2023\/03\/wooden-trojan-horse-400x260-1.jpg\",\"contentUrl\":\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2023\/03\/wooden-trojan-horse-400x260-1.jpg\",\"width\":400,\"height\":260,\"caption\":\"wooden Trojan horse on wheels malware art\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/cryptojacking-mac-malware-honkbox-found-in-pirated-apps\/#webpage\",\"url\":\"https:\/\/www.intego.com\/mac-security-blog\/cryptojacking-mac-malware-honkbox-found-in-pirated-apps\/\",\"name\":\"Cryptojacking Mac malware \\\"Honkbox\\\" found in pirated apps - The Mac Security Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/cryptojacking-mac-malware-honkbox-found-in-pirated-apps\/#primaryimage\"},\"datePublished\":\"2023-03-10T07:33:33+00:00\",\"dateModified\":\"2024-04-18T10:10:51+00:00\",\"description\":\"Honkbox, a cryptojacking Mac malware family, has been distributed via Trojanized software found on The Pirate Bay. Here is everything you need to know to protect yourself from this threat.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/cryptojacking-mac-malware-honkbox-found-in-pirated-apps\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.intego.com\/mac-security-blog\/cryptojacking-mac-malware-honkbox-found-in-pirated-apps\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/cryptojacking-mac-malware-honkbox-found-in-pirated-apps\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.intego.com\/mac-security-blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Cryptojacking Mac malware &#8220;Honkbox&#8221; found in pirated apps\"}]},{\"@type\":\"Article\",\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/cryptojacking-mac-malware-honkbox-found-in-pirated-apps\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/cryptojacking-mac-malware-honkbox-found-in-pirated-apps\/#webpage\"},\"author\":{\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#\/schema\/person\/dcf592275ba6edde8d20f1e60029c6b1\"},\"headline\":\"Cryptojacking Mac malware &#8220;Honkbox&#8221; found in pirated apps\",\"datePublished\":\"2023-03-10T07:33:33+00:00\",\"dateModified\":\"2024-04-18T10:10:51+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/cryptojacking-mac-malware-honkbox-found-in-pirated-apps\/#webpage\"},\"wordCount\":2232,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/cryptojacking-mac-malware-honkbox-found-in-pirated-apps\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2023\/03\/wooden-trojan-horse-400x260-1.jpg\",\"keywords\":[\"Cryptojacking\",\"Cryptominer\",\"OSX\/Miner\",\"Stealer Malware\"],\"articleSection\":[\"Malware\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.intego.com\/mac-security-blog\/cryptojacking-mac-malware-honkbox-found-in-pirated-apps\/#respond\"]}]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#\/schema\/person\/dcf592275ba6edde8d20f1e60029c6b1\",\"name\":\"Joshua Long\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#personlogo\",\"inLanguage\":\"en-US\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/5ad29f4111ce14911abaa98cbbcdea42?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/5ad29f4111ce14911abaa98cbbcdea42?s=96&d=mm&r=g\",\"caption\":\"Joshua Long\"},\"description\":\"Joshua Long (@theJoshMeister), formerly Intego\\u2019s Chief Security Analyst, is a renowned security researcher and writer, and an award-winning public speaker. Josh has a master\\u2019s degree in IT concentrating in Internet Security and has taken doctorate-level coursework in Information Security. Apple has publicly acknowledged Josh for discovering an Apple\\u00a0ID authentication vulnerability. Josh has conducted cybersecurity research for well over 25 years, which is often featured by major news outlets worldwide. Keep up with Josh via X\/Twitter, LinkedIn, Facebook, Instagram, YouTube, Patreon, Mastodon, the JoshMeister on Security, and more. \\u2014\",\"sameAs\":[\"https:\/\/security.thejoshmeister.com\",\"https:\/\/www.facebook.com\/JoshLong\",\"https:\/\/www.instagram.com\/thejoshmeister\/\",\"https:\/\/www.linkedin.com\/in\/thejoshmeister\",\"https:\/\/www.pinterest.com\/thejoshmeister\/\",\"https:\/\/twitter.com\/theJoshMeister\",\"https:\/\/www.youtube.com\/@theJoshMeister\"],\"url\":\"https:\/\/www.intego.com\/mac-security-blog\/author\/joshlong\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"description":"Honkbox, a cryptojacking Mac malware family, has been distributed via Trojanized software found on The Pirate Bay. Here is everything you need to know to protect yourself from this threat.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.intego.com\/mac-security-blog\/cryptojacking-mac-malware-honkbox-found-in-pirated-apps\/","og_locale":"en_US","og_type":"article","og_title":"Cryptojacking Mac malware \"Honkbox\" found in pirated apps - The Mac Security Blog","og_description":"Honkbox, a cryptojacking Mac malware family, has been distributed via Trojanized software found on The Pirate Bay. Here is everything you need to know to protect yourself from this threat.","og_url":"https:\/\/www.intego.com\/mac-security-blog\/cryptojacking-mac-malware-honkbox-found-in-pirated-apps\/","og_site_name":"The Mac Security Blog","article_author":"https:\/\/www.facebook.com\/JoshLong","article_published_time":"2023-03-10T07:33:33+00:00","article_modified_time":"2024-04-18T10:10:51+00:00","og_image":[{"width":400,"height":260,"url":"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2023\/03\/wooden-trojan-horse-400x260-1.jpg","type":"image\/jpeg"}],"twitter_card":"summary_large_image","twitter_creator":"@theJoshMeister","twitter_misc":{"Written by":"Joshua Long","Est. reading time":"12 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Organization","@id":"https:\/\/www.intego.com\/mac-security-blog\/#organization","name":"Intego","url":"https:\/\/www.intego.com\/mac-security-blog\/","sameAs":[],"logo":{"@type":"ImageObject","@id":"https:\/\/www.intego.com\/mac-security-blog\/#logo","inLanguage":"en-US","url":"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2022\/10\/intego-organization-logo-for-google-knowledge-graph-875x875-1.png","contentUrl":"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2022\/10\/intego-organization-logo-for-google-knowledge-graph-875x875-1.png","width":875,"height":875,"caption":"Intego"},"image":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/#logo"}},{"@type":"WebSite","@id":"https:\/\/www.intego.com\/mac-security-blog\/#website","url":"https:\/\/www.intego.com\/mac-security-blog\/","name":"The Mac Security Blog","description":"Keep Macs safe from the dangers of the Internet","publisher":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.intego.com\/mac-security-blog\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"ImageObject","@id":"https:\/\/www.intego.com\/mac-security-blog\/cryptojacking-mac-malware-honkbox-found-in-pirated-apps\/#primaryimage","inLanguage":"en-US","url":"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2023\/03\/wooden-trojan-horse-400x260-1.jpg","contentUrl":"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2023\/03\/wooden-trojan-horse-400x260-1.jpg","width":400,"height":260,"caption":"wooden Trojan horse on wheels malware art"},{"@type":"WebPage","@id":"https:\/\/www.intego.com\/mac-security-blog\/cryptojacking-mac-malware-honkbox-found-in-pirated-apps\/#webpage","url":"https:\/\/www.intego.com\/mac-security-blog\/cryptojacking-mac-malware-honkbox-found-in-pirated-apps\/","name":"Cryptojacking Mac malware \"Honkbox\" found in pirated apps - The Mac Security Blog","isPartOf":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/cryptojacking-mac-malware-honkbox-found-in-pirated-apps\/#primaryimage"},"datePublished":"2023-03-10T07:33:33+00:00","dateModified":"2024-04-18T10:10:51+00:00","description":"Honkbox, a cryptojacking Mac malware family, has been distributed via Trojanized software found on The Pirate Bay. Here is everything you need to know to protect yourself from this threat.","breadcrumb":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/cryptojacking-mac-malware-honkbox-found-in-pirated-apps\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.intego.com\/mac-security-blog\/cryptojacking-mac-malware-honkbox-found-in-pirated-apps\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.intego.com\/mac-security-blog\/cryptojacking-mac-malware-honkbox-found-in-pirated-apps\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.intego.com\/mac-security-blog\/"},{"@type":"ListItem","position":2,"name":"Cryptojacking Mac malware &#8220;Honkbox&#8221; found in pirated apps"}]},{"@type":"Article","@id":"https:\/\/www.intego.com\/mac-security-blog\/cryptojacking-mac-malware-honkbox-found-in-pirated-apps\/#article","isPartOf":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/cryptojacking-mac-malware-honkbox-found-in-pirated-apps\/#webpage"},"author":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/#\/schema\/person\/dcf592275ba6edde8d20f1e60029c6b1"},"headline":"Cryptojacking Mac malware &#8220;Honkbox&#8221; found in pirated apps","datePublished":"2023-03-10T07:33:33+00:00","dateModified":"2024-04-18T10:10:51+00:00","mainEntityOfPage":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/cryptojacking-mac-malware-honkbox-found-in-pirated-apps\/#webpage"},"wordCount":2232,"commentCount":0,"publisher":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/#organization"},"image":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/cryptojacking-mac-malware-honkbox-found-in-pirated-apps\/#primaryimage"},"thumbnailUrl":"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2023\/03\/wooden-trojan-horse-400x260-1.jpg","keywords":["Cryptojacking","Cryptominer","OSX\/Miner","Stealer Malware"],"articleSection":["Malware"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.intego.com\/mac-security-blog\/cryptojacking-mac-malware-honkbox-found-in-pirated-apps\/#respond"]}]},{"@type":"Person","@id":"https:\/\/www.intego.com\/mac-security-blog\/#\/schema\/person\/dcf592275ba6edde8d20f1e60029c6b1","name":"Joshua Long","image":{"@type":"ImageObject","@id":"https:\/\/www.intego.com\/mac-security-blog\/#personlogo","inLanguage":"en-US","url":"https:\/\/secure.gravatar.com\/avatar\/5ad29f4111ce14911abaa98cbbcdea42?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/5ad29f4111ce14911abaa98cbbcdea42?s=96&d=mm&r=g","caption":"Joshua Long"},"description":"Joshua Long (@theJoshMeister), formerly Intego\u2019s Chief Security Analyst, is a renowned security researcher and writer, and an award-winning public speaker. Josh has a master\u2019s degree in IT concentrating in Internet Security and has taken doctorate-level coursework in Information Security. Apple has publicly acknowledged Josh for discovering an Apple\u00a0ID authentication vulnerability. Josh has conducted cybersecurity research for well over 25 years, which is often featured by major news outlets worldwide. Keep up with Josh via X\/Twitter, LinkedIn, Facebook, Instagram, YouTube, Patreon, Mastodon, the JoshMeister on Security, and more. \u2014","sameAs":["https:\/\/security.thejoshmeister.com","https:\/\/www.facebook.com\/JoshLong","https:\/\/www.instagram.com\/thejoshmeister\/","https:\/\/www.linkedin.com\/in\/thejoshmeister","https:\/\/www.pinterest.com\/thejoshmeister\/","https:\/\/twitter.com\/theJoshMeister","https:\/\/www.youtube.com\/@theJoshMeister"],"url":"https:\/\/www.intego.com\/mac-security-blog\/author\/joshlong\/"}]}},"jetpack_featured_media_url":"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2023\/03\/wooden-trojan-horse-400x260-1.jpg","jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p4VAYd-pkd","amp_enabled":true,"_links":{"self":[{"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/posts\/97353"}],"collection":[{"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/users\/14"}],"replies":[{"embeddable":true,"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/comments?post=97353"}],"version-history":[{"count":24,"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/posts\/97353\/revisions"}],"predecessor-version":[{"id":97512,"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/posts\/97353\/revisions\/97512"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/media\/97354"}],"wp:attachment":[{"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/media?parent=97353"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/categories?post=97353"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/tags?post=97353"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}