Apple slips up on ChillyHell macOS malware, lets it past security . . . for 4 years

ChillyHell is a notarized, modular macOS backdoor (Intel C++) that researchers found publicly hosted since 2021 and likely active for years; it uses multiple persistence methods (LaunchAgent/LaunchDaemon and shell profile modification), timestomping evasion, interchangeable C2 protocols, and modules for downloading payloads, credential brute-forcing, and data collection, and has been linked to prior reporting attributing a variant to UNC4487.