The New and Improved macOS Backdoor from OceanLotus - Palo Alto Networks Blog

A detailed analysis of a sophisticated OceanLotus macOS backdoor that uses disguised application bundles and decoy documents for persistence, communicates with a custom encrypted C2 protocol on port 443 using a modular architecture that can load additional libraries, and targets victims in Vietnam with evidence of ongoing activity.