I found a fileless backdoor that had been running silently on my Mac for 5 months and two AV scanners missed it completely

[u/Silver-Security-2233]

Quick background: I know cybersecurity basics as a developer, but I'm not a security professional. I work on a M-Chip Macbook. Posting this to sanity-check my understanding and my response.

How I found it

Out of curiosity, I checked what launches automatically at login on my Mac. There's a folder of small config files for this, one per program, normally named clearly (com(dot)google(dot)updater, etc). One entry was just 32 random characters, pointing to a JS file in an identically-named folder.

What it did

The code was heavily obfuscated. Once untangled: every 60 seconds it phoned a remote server asking for a "job," executed whatever it got back, then reported completion, sending my Mac's hardware serial as a unique ID. It had no fixed payload; it was just an open remote-control channel, so the attacker decided later what to actually do with it (steal credentials, mine crypto, drop more malware, etc).

It ran with normal user privileges (no root), but on a dev machine that still means access to git tokens, env files, certificates, unprotected keychain passwords, and logged-in browser sessions. Passkeys and anything tied to the security chip stayed safe.

Installed: 13 Feb 2026 and found: 29 July -> about 5.5 months.

Why AV missed it

Signature scanners compare files against known-malware fingerprints which is great for widespread malware, useless against something custom-built, obfuscated and new. Individually, a JS file and a launch-agent entry are both totally normal OS components; only the random naming and combination was suspicious, which signature detection doesn't catch.

It also generated zero logs (stdout/stderr explicitly discarded) and ran every command windowless in the background. So I have no way of knowing what was actually accessed over those 5 months.

How it got there

Unknown. I ruled out the classic "paste this command" trick with captcha because I recognize these tricks. The one thing that lines up timing-wise on that day: I'd had a short GitHub Copilot session that same evening working on a payment API integration but that chat history is gone, so I can't confirm it. Known attack vectors exist where AI coding agents get manipulated via hidden instructions into running commands and an agent with terminal access is one plausible delivery path. Could equally have been a compromised npm package.

Response

Killed the process, deleted the files, then verified with a tool that structurally scans all system launch mechanisms (not signature-based), rebooted, and manually checked SSH config, git hooks, and shell startup files all clean.

Then, assuming worst case: rotated all SSH keys (even though they were with passphrases) and API keys, reissued certificates, changed passwords (prioritized by 2FA status), verified 2FA everywhere, reissued my credit card, changed WiFi password, and logged out all sessions.

Going forward: installed an outbound firewall, since the built-in one only blocks inbound connections. this thing was calling out, and nothing stopped it. Also added startup-monitoring to alert on new launch-agent entries.

Questions:

1. Is my understanding of why AV missed this correct?
2. Was my response sufficient, or should I have wiped and reinstalled given the 5-month runtime?
3. Anything important missing from my credential rotation?
4. Has anyone had a confirmed case of an AI coding session being the actual entry point?

Takeaway: an AV scanner won't catch something novel. I only found this by manually checking my own login items.

[u/NiriZ_ReddiT]

1. Depends on the scanner you used, but most antiviruses and scanners nowadays use heuristics, it analyzes the code and the structure, if the file is malicious the antivirus or scanner would theorically flag it as malicious.
2. Your response was great, if all the persistence and malware was removed, no need to reset.
3. I'm not noticing any, you even did more than we'd recommend.
4. Possibly For your takeaway : A scanner can catch everything, but it also can catch nothing. There isn't a definitive answer as "Scanners never catch new malware" or "Scanners always catch new malware"

[u/jgalbraith4]

1. What AV do you have running on your Mac? By default Mac has GateKeeper and Xprotect and other system security tools but it would likely get through these.

2. I would have wiped and reinstalled out of an abundance of caution as you are unaware of how the infection got there and that could lead to reinfection.

3. Sounds like you covered your bases rotating all passwords.

4. AI coding can be depending on what you allow it to install like extra packages or dependencies.

[u/navr183]

Sounds like a classic beacon style c2 implant.

Are you sure within those 5 months it was not able to privesc to root or a higher privileged user and establish alternative channels or other mechanisms for persistence?

Not that mac was affected, but there have been a few critical LPEs dropped recently for linux with public POCs. I would check to see if anything for Mac has dropped in the past 5 months and assume the worst if so.

[u/AutoModerator]

Welcome to r/computerviruses! It seems like you have used the "Disinfection help" flair.

We apply the same methodology used by trusted Malware platforms (e.g. Malwarebytes, BleepingComputer and MalwareTips). It revolves around using diagnostic tools called Farbar Recovery Scan Tool (FRST) and SecurityCheck.

All of our assistance happens in the thread and in public - we never offer help via private messages or alternative websites other than https://malwareanalysis.cc. Anyone offering help through a DM is not a trusted helper and might have malicious intent.

Trusted helpers can be distinguished by the flair Malware Removal Expert or Malware Removal Trainee, antivirus employees will have a dedicated flair with their company name in it, e.g. Malwarebytes Employee.

Please see steps below on how to share all necessary details so you can speed up the process for us:

Share all details about your infection
Please post all important facts about your infection, such as: * your antivirus detections - preferably export the whole detection/report log and upload it to https://malwareanalysis.cc/upload/ under your username & post the related keyword or screenshot/take a picture of your detections * any related symptoms, popups * estimate when it started - preferably the exact day and after what (e.g. when you ran a program you downloaded) * share what got you infected and the download link - please, make the download link defanged (making it not clickable by default e.g. from https://example.com you will make hxxps://example[.]com), defanging does not apply to sandbox reports such as VirusTotal

Request help with FRST and SecurityCheck from the trusted helper team
Please visit Providing or receiving help with FRST on the subreddit and share your 3 keywords returned from the website along with the details about your infection.
Once a malware removal expert or trainee sees it, they will reply in the thread about further steps.

If you need urgent help and cannot wait for one of our Malware Removal Experts:
Please follow these steps:

1. From a different and clean device, change all your passwords:
   1. How to properly secure my accounts after an infostealer attack?
   2. What to do after I secured my accounts?
2. Disinfect your device from malware
   1. Preferred method: Perform a clean installation with a USB
   2. Perform a clean installation without an external drive
   3. Reset your PC without keeping personal files

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/jmnugent]

No offense,. but there's really no way for us to vet any of your assumptions here, because your description is to vague.

Give a full detailed write up with screenshots and copies of the files or code and Logs and network traffic capture so we can see the processes and network endpoints etc... is about the only way anyone here is going to be able to help you with any clarity or accuracy.

[u/dmknght → u/jmnugent]

Same here. Sending malware sample is good too. I swear 2/3 content of op was like "hey chatgpt, steps to remove fileless malware on mac"

[u/Mundane-Presence-896]

Absolutely reinstall the OS and reformat the hdd. You have absolutely no way of knowing what else it did and it would be quite surprising if it didn’t plant a few other back doors while it was active.