Stealthy New macOS Backdoor Hides on Chinese Websites

Jamf Threat Labs found trojanized macOS applications hosted on Chinese pirating sites that contain a hidden ".fseventsd" binary and malicious dylib which drop a Khepri-derived backdoor and a downloader. The malware establishes persistence, collects system information, supports file upload/download and remote shells, and uses stealth techniques (renaming, hiding) to evade detection; users should avoid pirated apps and deploy macOS-focused detection and web filtering.