Hackers Abuse EV Certificates to Sign Completely Undetectable DMG Malware
Security researchers have identified a new macOS malware campaign involving the misuse of Extended Validation (EV) code-signing certificates to distribute fully undetectable (FUD) disk image (DMG) payloads.
Security researchers have identified a new macOS malware campaign involving the misuse of Extended Validation (EV) code-signing certificates to distribute fully undetectable (FUD) disk image (DMG) payloads.
This development marks a significant escalation in code-signing exploitation on macOS, a practice previously prevalent in the Windows ecosystem.
A recent DMG sample (SHA-256: a031ba8111ded0c11acfede9ab83b4be8274584da71bcc88ff72e2d51957dd7) was signed by a new Developer ID: THOMAS BOULAY DUVAL (J97GLQ5KW9).
EV certificates require extensive identity verification and significant financial investment by legitimate developers. These certificates are considered the gold standard for code-signing trust on Apple's platform. However, adversaries have obtained these certificates through theft, illicit purchase, or compromised identity documents to sign their malware. Once signed, DMG payloads appear legitimate to macOS security checks and are easily installed by users.
The campaign operators append fragments of the signer's name to the bundle identifier to attempt legitimacy—for example, balaban.sudoku mimics "Alina Balaban," and thomas.parfums echoes "Thomas Boulay Duval." Despite this tactic, deeper inspection reveals malicious behavior.
This development marks a significant escalation in code-signing exploitation on macOS, a practice previously prevalent in the Windows ecosystem.
Analysis of the Mach-O executable within the DMG reveals multiple references to the French word "parfums" embedded in string tables. The embedded AppleScript is fetched at runtime from a remote URL (franceparfumes[.]org/parfume). Once executed, the AppleScript drops and runs a second-stage payload identified as Odyssey Stealer, a credential-harvesting trojan previously seen in Windows deployments.
The script uses system APIs via Swift’s dataTaskWithURL:completionHandler: method to download the stealer binary and execute it under the signed container without raising alerts.
The misuse of EV certificates in this context undermines Apple's code-signing trust model. Once such certificates are reported and added to the revocation list, subsequent malware campaigns will fail to launch on updated systems. However, the window for undetected deployment can last long enough to compromise numerous victims.
SHA-256: a031ba8111ded0c11acfede9ab83b4be8274584da71bcc88ff72e2d51957dd7 Domain: franceparfumes[.]org/parfume IP address: 185.93.89.62
Security teams can monitor EV certificates abused by Odyssey Stealer via CertCentral’s public lookup at certcentral.org/lookup?detail_type=malware&query=Odyssey+Stealer.
The use of EV certificates to sign macOS malware represents a significant shift in code-signing exploitation. Organizations and end users must remain vigilant by verifying certificate legitimacy beyond Gatekeeper prompts and leveraging threat-intelligence feeds to block malicious domains and revoked certificates. Prompt reporting and revocation of abused EV certificates are essential to disrupting these campaigns and safeguarding macOS environments from similarly signed threats.
Based on reporting by GBHackers.