macOS backdoor toolkit: how JokerSpy works and how to stay safe

A macOS backdoor gives attackers quiet, remote control of a Mac, and the JokerSpy toolkit showed how far such tools can go. Here is how it worked and how to protect yourself, with Hide Expert VPN as one layer of a wider defense.

What researchers found in the macOS toolkit

In 2023, researchers at an antivirus company analyzed several malware samples that an anonymous victim had uploaded to VirusTotal, a service that checks files against many security engines. The samples had low detection rates and little public information about them, and the malware became known under the name JokerSpy.

Together, the files looked like parts of a larger toolkit with backdoor capabilities aimed at macOS. It included two Python-based backdoors that can also run on Windows and Linux, plus a separate macOS-only component. The researchers believed the files were pieces of a more sophisticated attack rather than a finished, standalone product.

How the JokerSpy macOS backdoor components worked

Each part of the toolkit had its own job:

• shared.dat – a backdoor that checks which operating system it is running on, then contacts the attackers' server for instructions. It can collect system information, run commands, download and launch files, and shut the computer down. On a Mac, it writes encoded content to a file called AppleAccount.tgz, which is unpacked and launched as an application. On Linux, it creates a small C program and compiles it instead.
• sh.py – a more powerful backdoor that can collect system data, search for and delete files, run commands and files sent by the attackers, and steal data.
• A macOS FAT binary – a program that checks which permissions it has before using a likely spyware component, probably meant to capture the screen. The spyware module itself was not part of the samples.

This modular design is typical of targeted attacks. A small first-stage tool checks the environment and reports back, and heavier components arrive only when the attacker decides the victim is worth the effort.

Who is at risk and how infections start

At the time of the report, the exact origin of the samples and the first infection step were unknown. Researchers suspected social engineering or targeted phishing – common ways to get a first foothold on a Mac, where a convincing message persuades someone to open a file, run a script or approve a permission prompt.

Targeted toolkits like this one usually aim at people whose access is valuable: developers, IT staff, executives and crypto holders. The same tricks also appear in mass campaigns, and AI tools now help criminals write convincing phishing emails, so treat every unexpected attachment with suspicion.

JokerSpy is not the only threat aimed at Apple computers either. Researchers have also found that LockBit ransomware can target macOS, which undermines the old idea that attackers ignore Macs.

How to protect your Mac from backdoor malware

Most of these steps take a few minutes and work against far more than one malware family:

1. Keep macOS and apps updated. Turn on automatic updates in System Settings so security fixes and Apple's malware definitions install without delay.
2. Install software only from trusted sources. Use the App Store or the developer's official site, and do not override Gatekeeper warnings for files you did not expect.
3. Do not run unknown scripts. Python, shell and AppleScript files from strangers or unvetted code repositories can do anything your user account can do.
4. Review privacy permissions. In System Settings, open Privacy & Security and check the screen recording, accessibility and full disk access lists. Remove apps you do not recognize – the JokerSpy FAT binary checked its permissions before trying to spy, so limiting them matters.
5. Check login and background items. Malware often sets itself to start automatically, so look for unfamiliar entries in the login items section of System Settings.
6. Use unique passwords and two-factor authentication. Stolen data does less harm if a password alone is not enough to sign in.

On public or shared networks, an encrypted connection such as Hide Expert VPN stops local snoopers from reading your traffic. It does not remove malware, though, so treat it as one layer next to updates and careful habits.

What to do if you suspect an infection

Warning signs include unknown processes using a lot of CPU, new apps or login items you did not add, and permission prompts that appear out of nowhere. If you notice them, disconnect from the network, back up important files, and follow a step-by-step guide to scan your Mac for malware. After cleaning up, change your passwords from a device you trust.

Backdoors that steal data often go after saved logins and browser data – the same goal pursued by information stealers like Stealc. Changing passwords quickly limits what attackers can do with anything they took.

Conclusion

The JokerSpy toolkit showed that attacks on macOS can be modular, quiet and hard to detect at first. You do not need special tools to defend yourself: keep your Mac updated, be skeptical of unexpected files, review permissions regularly and act quickly when something looks wrong.