Threat intelligence / Malware

macOS.OSAMiner

[macOS.OSAMiner](https://attack.mitre.org/software/S1048) is a Monero mining trojan that was first observed in 2018; security researchers assessed [macOS.OSAMiner](https://attack.mitre.org/software/S1048) may have been circulating since at least 2015. [macOS.OSAMiner](https://attack.mitre.org/software/S1048) is known for embedding one run-only AppleScript into another, which helped the malware evade full analysis for five years due to a lack of Apple event (AEVT) analysis tools.(Citation: SentinelLabs reversing run-only applescripts 2021)(Citation: VMRay OSAMiner dynamic analysis 2021)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[macOS.OSAMiner](https://attack.mitre.org/software/S1048) is a Monero mining trojan that was first observed in 2018; security researchers assessed [macOS.OSAMiner](https://attack.mitre.org/software/S1048) may have been circulating since at least 2015. [macOS.OSAMiner](https://attack.mitre.org/software/S1048) is known for embedding one run-only AppleScript into another, which helped the malware evade full analysis for five years due to a lack of Apple event (AEVT) analysis tools.(Citation: SentinelLabs reversing run-only applescripts 2021)(Citation: VMRay OSAMiner dynamic analysis 2021)

Labels

malware

11 recorded

Relationships

uses

Technique

uses

to Disable or Modify Tools

Technique

uses

to Embedded Payloads

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Launch Agent

Technique

uses

Technique

uses

to Local Storage Discovery

Technique

uses

to Process Discovery

Technique

uses

to Stripped Payloads

Technique

uses

to System Checks

Technique

uses

to System Information Discovery

Technique

3 external

References

mitre-attack

S1048

SentinelLabs reversing run-only applescripts 2021

https://www.sentinelone.com/labs/fade-dead-adventures-in-reversing-malicious-run-only-applescripts/

VMRay OSAMiner dynamic analysis 2021

https://www.vmray.com/cyber-security-blog/osaminer-uses-applescripts-evade-detection-malware-analysis-spotlight/