Researchers from cybersecurity firm ESET discovered a new and previously undocumented spyware targeting MacOS systems. The malware, which the researchers dubbed “CloudMensis,” exfiltrates documents, logs keystrokes, and captures screenshots on the victim device. CloudMensis is written in Objective-C, a programming language created by Apple for use with MacOS. The researchers could not find an initial infection vector or how it gained administrator privileges. However, they did find a component in the malware that appeared to clean up after a Safari sandbox escape exploit, though the functions were never called in the current version of the malware. Through further research, the researchers linked the component to four Safari vulnerabilities discovered and patched in 2017, indicating that previous versions may have used them as a distribution technique. Once it is installed on a victim device and given administrator access, the malware initiates a two (2) step process to retrieve the final payload. The first stage of the download utilizes cloud storage providers pCloud, Yandex, and Dropbox to download stage two (2) through an access token, allowing the download to be hosted privately rather than using a public link. The second stage is installed as a “system-wide” daemon and a configuration file is loaded into it, allowing victim-specific settings such as which cloud storage provider to use or file extensions that may be of interest to the malware operator. CloudMensis communicates to its command-and-control (C2) server using the previously mentioned cloud hosting services and uses a custom encryption method created by the developer. The malware’s operator can run up to thirty-nine (39) different commands on a victim’s machine, allowing the following functionality: changing CloudMensis configuration values, list running processes, start a screen capture, list email messages, view files from removable storage, run shell commands, and download and execute files. Some of these commands are normally protected by a system called “Transparency, Consent, and Control” (TCC) that was implemented in MacOS Mojave to prevent sensitive inputs from being accessed without a user’s permission. CloudMensis uses a vulnerability tracked as CVE-2020-9934 to bypass this protection mechanism. By utilizing the access tokens used by the malware to interact with cloud service providers, the researchers were able to create a timeline of the various CloudMensis infections. This timeline indicates CloudMensis is used in very targeted attacks and, though it is a threat to Mac users at large, it is likely only used against targets of interest to the operator. CloudMensis has not been attributed to a threat actor or geographical area and little is known about the targets of the malware. Due to the malware using old vulnerabilities, CTIX analysts recommend users and organizations ensure their MacOS devices are up to date and not vulnerable to the exploit used by CloudMensis.