macOS Malware Campaign Showcases Novel Delivery Technique

Researchers (Kaspersky and SentinelOne) have uncovered the 'Activator' macOS backdoor campaign that distributes malware via cracked copies of popular applications. Attackers supply an unusable cracked app plus an 'Activator' helper that prompts for admin credentials to disable Gatekeeper, turns off notifications, installs a Launch Agent, and launches a Python-based backdoor (running from memory) which serves as a first-stage downloader; SentinelOne observed a high volume of unique samples across many cracked-app lures (roughly 70 distinct applications), raising concerns about widespread infections and a potential macOS botnet.