Currently viewing ATT&CK v19.1 which is the current version of ATT&CK. Learn more about the versioning system or see the live site.
ATT&CKcon 7.0 is coming October 27-28, 2026. Learn more about ATT&CKcon 7.0.
  1. Home
  2. Software
  3. Janicab

Janicab

Janicab is an OS X trojan that relied on a valid developer ID and oblivious users to install it. [1]

ID: S0163
ⓘ
Type: MALWARE
ⓘ
Platforms: macOS
Version: 1.1
Created: 14 December 2017
Last Modified: 12 September 2024
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1123 Audio Capture

Janicab captured audio and sent it out to a C2 server.[2][1]
Enterprise T1053 .003 Scheduled Task/Job: Cron

Janicab used a cron job for persistence on Mac devices.[1]
Enterprise T1113 Screen Capture

Janicab captured screenshots and sent them out to a C2 server.[2][1]
Enterprise T1553 .002 Subvert Trust Controls: Code Signing

Janicab used a valid AppleDeveloperID to sign the code to get past security restrictions.[1]

References

  1. Thomas. (2013, July 15). New signed malware called Janicab. Retrieved July 17, 2017.
  1. Brod. (2013, July 15). Signed Mac Malware Using Right-to-Left Override Trick. Retrieved July 17, 2017.