A new trojan has been discovered in-the-wild targeting macOS, distributed through pirated versions of business software. The malware begins by disguising itself as a program the user is trying to download, but once it is installed it creates a hidden proxy server within the system. This creates a backdoor into the network and also allows for traffic to be redirected through the infected device. This can allow the threat actor to utilize the victim’s network and devices for a variety of purposes such as use in a botnet, redirecting internet traffic through the network to obfuscate illegal activity, or further install more malware onto the network. The threat actors have configured the trojan to use DNS-over-HTTPS, also known as DoH, to trick security services into thinking the traffic is non-malicious in nature. This allows the trojan to communicate to the command-and-control (C2) server without alerting the network owners. It is noted however that the C2 server is located at one location and does not appear to have backups, meaning that blocking that C2 server IP can permanently cripple the current version of the trojan. Another notable feature is that the trojan creates multiple files that it does not remove, allowing for easier identification of the trojan. This new trojan, albeit somewhat simple, is part of a wave that took off in 2019 of macOS trojans that appear to be targeting casual users to grow botnets in size and ability. CTIX analysts will continue to monitor the prevalence of botnet trojans and their ever-increasing target spread.