Skip to content

S0163 Janicab

Janicab is an OS X trojan that relied on a valid developer ID and oblivious users to install it. 1

Item Value
ID S0163
Associated Names
Version 1.1
Created 14 December 2017
Last Modified 19 March 2020
Navigation Layer View In ATT&CK® Navigator

Techniques Used

Domain ID Name Use
enterprise T1123 Audio Capture Janicab captured audio and sent it out to a C2 server.21
enterprise T1053 Scheduled Task/Job -
enterprise T1053.003 Cron Janicab used a cron job for persistence on Mac devices.1
enterprise T1113 Screen Capture Janicab captured screenshots and sent them out to a C2 server.21
enterprise T1553 Subvert Trust Controls -
enterprise T1553.002 Code Signing Janicab used a valid AppleDeveloperID to sign the code to get past security restrictions.1


Back to top