s1
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

TF-MAL-osx.wirelurker

📛 Threat Title

Malware family: WireLurker

Category: WireLurker First seen: Last updated: Source: ThreatFox Malwares

Description

ThreatFox malware family `osx.wirelurker`. Printable name: WireLurker.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

domain osx.wirelurker VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/osx.wirelurker

IOC database

Type
domain
Value
osx.wirelurker
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
Extracted from Threat TF-MAL-osx.wirelurker

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/osx.wirelurker

References (1)

Remediations (9)

  • WireLurker, Software S0312 | MITRE ATT&CK®
    web:attack.mitre.org

    WireLurker is a family of macOS malware that targets iOS devices connected over USB. [1]

  • FBI warns of ATM jackpotting surge | Cybernews
    web:cybernews.com

    The FBI warns of a surge in ATM jackpotting attacks, with more than 700 incidents in 2025 alone. Hackers use Ploutus malware to force machines to dispense cash.

  • Wirelurker - Wikipedia
    web:en.wikipedia.org

    WireLurker is a family of malware targeting both macOS and iOS systems. [1] The malware was designed to target users in China that use Apple mobile and desktop devices. [2]

  • How to (technically) detect Windows variant of WireLurker
    web:github.com

    How to (technically) detect Windows variant of WireLurker Background This is a document for technical guys. We also found a new variant of WireLurker that exists in both Windows and OS X. While the OS X detection code was updated to cover this variant, we decide to only fully disclose how to technically detect its Windows samples.

  • PDF WRELRKER WI - papers.put.as
    web:papers.put.as

    WireLurker Workflow and Malware Progression This section summarizes WireLurker's workflow and malware progression (Figure 5), which are described in further detail in subsequent sections.

  • Malware Incident Response: The 7-Step Playbook for 2025 - Breachsense
    web:www.breachsense.com

    Complete malware remediation now requires addressing both the infected endpoint and the stolen authentication data. Your malware incident response playbook must account for both.

  • Technical Approaches to Uncovering and Remediating Malicious ... - CISA
    web:www.cisa.gov

    It highlights technical approaches to uncovering malicious activity and includes mitigation steps according to best practices. The purpose of this report is to enhance incident response among partners and network administrators along with serving as a playbook for incident investigation.

  • Mitigating malware and ransomware attacks - The National Cyber Security ...
    web:www.ncsc.gov.uk

    How to defend organisations against malware or ransomware attacks.

  • What Is WireLurker? How It Works & Examples | Twingate
    web:www.twingate.com

    This malware family is particularly concerning because it automates the generation of malicious iOS applications and employs advanced techniques like file hiding, code obfuscation, and encryption to evade detection. WireLurker's discovery marked a new era in the landscape of Apple device security threats. How does WireLurker Work?

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.