TF-MAL-osx.sugarloader

Description

ThreatFox malware family `osx.sugarloader`. Printable name: SUGARLOADER.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (1)

• ThreatFox: IOCs for this family ThreatFox Malwares

• SocGholish, Software S1124 | MITRE ATT&CK®
  web:attack.mitre.org

  SocGholish is a JavaScript-based loader malware that has been used since at least 2017. It has been observed in use against multiple sectors globally for initial access, primarily through drive-by-downloads masquerading as software updates.

  2026-05-22 05:29 UTC
• UNC1069 Targets Cryptocurrency Sector with New Tooling and AI-Enabled ...
  web:cloud.google.com

  Subsequently, Mandiant identified seven distinct malware families during the forensic analysis of the compromised system, with SUGARLOADER being the only malware family already tracked by Mandiant prior to the investigation.

  2026-05-22 05:29 UTC
• Lazarus Group Uses New Type of Malware - coinspaidmedia.com
  web:coinspaidmedia.com

  Lazarus Group hackers are using a new type of malware called Kandykorn. It enters the victim's computer through social engineering techniques and a special loader program called Sugarloader .

  2026-05-22 05:29 UTC
• UNC1069 ClickFix Attack: Crypto Wallets & Browser Threats | Hive Pro
  web:hivepro.com

  The UNC1069 cryptocurrency attack resulted in the deployment of seven distinct malware families — WAVESHAPER, SUGARLOADER , SILENCELIFT, HYPERCALL, DEEPBREATH, HIDDENCALL, and CHROMEPUSH — engineered to harvest credentials, browser data, messaging content, and session tokens to facilitate large-scale cryptocurrency theft.

  2026-05-22 05:29 UTC
• Axios Poisoned: UNC1069's npm Supply Chain Playbook
  web:labs.cloudsecurityalliance.org

  Axios Poisoned: UNC1069's npm Supply Chain Playbook Key Takeaways On March 31, 2026, the npm package axios — the most downloaded JavaScript HTTP client library with over 100 million weekly downloads — was compromised after a North Korea-nexus threat actor designated UNC1069 socially engineered the project's lead maintainer [1] [2]. The attack introduced a malicious transitive ...

  2026-05-22 05:29 UTC
• SUGARLOADER (Malware Family) - Fraunhofer
  web:malpedia.caad.fkie.fraunhofer.de

  Details for the SUGARLOADER malware family including references, samples and yara signatures.

  2026-05-22 05:29 UTC
• Malware Incident Response: The 7-Step Playbook for 2025 - Breachsense
  web:www.breachsense.com

  Complete malware remediation now requires addressing both the infected endpoint and the stolen authentication data. Your malware incident response playbook must account for both.

  2026-05-22 05:29 UTC
• Technical Approaches to Uncovering and Remediating Malicious ... - CISA
  web:www.cisa.gov

  It highlights technical approaches to uncovering malicious activity and includes mitigation steps according to best practices. The purpose of this report is to enhance incident response among partners and network administrators along with serving as a playbook for incident investigation.

  2026-05-22 05:29 UTC
• Trojan:MacOS/SugarLoader!MTB - microsoft.com
  web:www.microsoft.com

  Understand how this virus or malware spreads and how its payloads affects your computer. Protect against this threat, identify symptoms, and clean up or remove infections.

  2026-05-22 05:29 UTC
• Mitigating malware and ransomware attacks - The National Cyber Security ...
  web:www.ncsc.gov.uk

  How to defend organisations against malware or ransomware attacks.

  2026-05-22 05:29 UTC

Only Available for Registered Users. Sign in to view.