LightSpy Malware Variant Targeting macOS | Huntress

Huntress analyzed a VirusTotal sample of the LightSpy framework and determined it is a macOS implant (x86_64) rather than iOS; the report details a three-stage architecture (dropper, implant dylib, plugins), plugin capabilities (audio recording, camera, screen recording, file and keychain access, remote shell, etc.), encryption/decryption and C2 mechanisms (WebSockets, macmanifest.json), IOCs (SHA1/SHA256 hashes, filenames) and infrastructure (primary C2 103.27.109.217), and provides YARA/Sigma detection rules and mitigations while noting limited evidence of a broader campaign and prior associations with APT41.