Yes. Jamf Threat Labs disclosed a macOS malware campaign on January 18, 2024, in which pirated Mac applications hosted on Chinese websites carried a hidden backdoor and downloader. The malware could collect system information, run commands and additional payloads, and transfer files. The practical defense is to avoid cracked apps; this campaign used software that appeared useful to entice people to install it.
What is the .fseventsd backdoor?
.fseventsd is the name of a malicious executable Jamf Threat Labs found while investigating macOS threat alerts. Its leading period makes the file hidden in ordinary Finder views, and its name imitates a legitimate macOS process. Jamf reported that the sample was not signed by Apple and had no VirusTotal detections at the time of its analysis.
That finding describes the sample and its detection status at that time; it does not establish that every security product missed it or that it remains undetected today.
How did the pirated-app infection work?
Jamf linked the malware to trojanized disk images distributed through piracy sites, including the Chinese site macyy[.]cn. The report named these affected DMG files: navicat161_premium_cs.dmg, ultraedit.dmg, FinalShell.dmg, secureCRT.dmg, and Microsoft-Remote-Desktop-Beta.dmg. Jamf also noted two other trojanized DMGs that had not yet appeared on VirusTotal.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitches#1 Best Overall
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
Three components in the chain
- A malicious dylib: The library loads when the application opens and acts as a dropper, installing the next components.
- A Khepri-like backdoor: This component provides command-and-control and post-exploitation functions.
- A persistent downloader: It contacts attacker infrastructure, saves a downloaded response as
/tmp/.fseventsds, then launches that executable.
How it stayed on the Mac
The downloader created ~/Library/LaunchAgents/com.apple.fsevents.plist, a LaunchAgent whose Apple-like name could make it look routine. The plist instructed macOS to relaunch /Users/Shared/.fseventsd. A hidden filename and a system-sounding service label can make suspicious software less noticeable, but neither makes it a legitimate Apple component.
What could the backdoor do?
Jamf and Dark Reading describe capabilities including system-information collection, remote-shell access, execution of additional payloads, and file upload and download. Some actions depend on the permissions available to the malware on the infected Mac; the reported capabilities do not mean every action would succeed on every system.
Rank #2
![Norton 360 Premium 2027 Antivirus, 10 Devices, Auto-Renews [Download]](https://m.media-amazon.com/images/I/41JNWru8mYL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 10 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
Does the campaign prove a connection to ZuRu?
No. Jamf and Dark Reading noted similarities to the ZuRu campaign, including the use of compromised popular applications, malicious dylibs, and infrastructure patterns. However, the final payload differs substantially, and the available reporting does not establish that this was the same malware or the same operator. Khepri refers to the backdoor’s technical lineage or functionality, not necessarily the identity of whoever deployed it.
The samples were observed on Chinese piracy sites, which describes their distribution and likely targeting context. The reporting does not prove that the site operator created the malware or establish the operator’s nationality. Jamf’s disclosure and Dark Reading’s coverage were dated January 18, 2024; neither reported an authoritative victim count, infection total, financial loss estimate, or prevalence percentage.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #3
![Norton 360 Deluxe 2027 Antivirus, 3 Devices, Auto-Renews [Download]](https://m.media-amazon.com/images/I/41qw3FS3qLL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 3 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
How to reduce the risk on a Mac
- Avoid cracked and pirated applications. In this campaign, the installer was the delivery route. A familiar app name does not prove a downloaded copy is safe.
- Use macOS threat detection. For organizations, Jamf’s researchers recommended endpoint software that detects and blocks Mac threats.
- Apply web controls in managed environments. Organizations can restrict access to websites known to host pirated software, reducing the chance that users reach a malicious download.
- Do not treat a lack of an alert as proof of safety. The sample was unsigned and initially had no VirusTotal detections, so detection tools should complement—not replace—safe download practices.
What to do if you opened a suspicious pirated app
If you suspect a Mac has run one of these installers, stop using the downloaded application and do not enter passwords or other sensitive information into it. On a work or school Mac, contact the organization’s IT or security team promptly and follow its incident-response instructions. The public reporting describes this campaign’s components and capabilities but does not provide a verified one-size-fits-all cleanup procedure.
Quick Recap
Best Value
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
Rank #4
![Norton 360 Deluxe 2027 Antivirus, 5 Devices, Auto-Renews [Download]](https://m.media-amazon.com/images/I/41IYV5zGyCL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 5 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
