H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

CookieMiner

[CookieMiner](https://attack.mitre.org/software/S0492) is mac-based malware that targets information associated with cryptocurrency exchanges as well as enabling cryptocurrency mining on the victim system itself. It was first discovered in the wild in 2019.(Citation: Unit42 CookieMiner Jan 2019)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[CookieMiner](https://attack.mitre.org/software/S0492) is mac-based malware that targets information associated with cryptocurrency exchanges as well as enabling cryptocurrency mining on the victim system itself. It was first discovered in the wild in 2019.(Citation: Unit42 CookieMiner Jan 2019)

Labels

malware
14 recorded

Relationships

uses
to Command Obfuscation
Technique
uses
to Compute Hijacking
Technique
uses
to Credentials from Web Browsers
Technique
uses
to Data from Local System
Technique
uses
to Deobfuscate/Decode Files or Information
Technique
uses
to Disable or Modify System Firewall
Technique
uses
to Exfiltration Over Unencrypted Non-C2 Protocol
Technique
uses
to File and Directory Discovery
Technique
uses
to Ingress Tool Transfer
Technique
uses
to Launch Agent
Technique
uses
to Python
Technique
uses
to Security Software Discovery
Technique
uses
to Steal Web Session Cookie
Technique
uses
to Unix Shell
Technique
2 external

References

mitre-attack
S0492
open
Unit42 CookieMiner Jan 2019
https://unit42.paloaltonetworks.com/mac-malware-steals-cryptocurrency-exchanges-cookies/
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance