OSX/Keydnap spreads via signed Transmission application By ESET Research Archived: 2026-04-05 18:54:16 UTC ESET Research During the last hours, OSX/Keydnap was distributed on a trusted website, which turned out to be “something else”. It spread via a recompiled version of the otherwise legitimate open source BitTorrent client application Transmission and distributed on their official website. 30 Aug 2016  •  , 6 min. read Last month ESET researchers wrote an article about a new OS X malware called OSX/Keydnap, built to steal the content of OS X’s keychain and maintain a permanent backdoor. At that time of the analysis, it was unclear how victims were exposed to OSX/Keydnap. To quote the original article: “It could be through attachments in spam messages, downloads from untrusted websites or something else.” During the last hours, OSX/Keydnap was distributed on a trusted website, which turned out to be “something else”. It spread via a recompiled version of the otherwise legitimate open source BitTorrent client application Transmission and distributed on their official website. Instant response from the Transmission team Literally minutes after being notified by ESET, the Transmission team removed the malicious file from their web server and launched an investigation to identify how this happened. At the time of writing, it was impossible to tell exactly when the malicious file was made available for download. According to the signature, the application bundle was signed on August 28th, 2016, but it seems to have been distributed only the next day. Thus, we advise anyone who downloaded Transmission v2.92 between August 28th and August 29th, 2016, inclusively, to verify if their system is compromised by testing the presence of any of the following file or directory: /Applications/Transmission.app/Contents/Resources/License.rtf /Volumes/Transmission/Transmission.app/Contents/Resources/License.rtf $HOME/Library/Application Support/com.apple.iCloud.sync.daemon/icloudsyncd $HOME/Library/Application Support/com.apple.iCloud.sync.daemon/process.id $HOME/Library/LaunchAgents/com.apple.iCloud.sync.daemon.plist /Library/Application Support/com.apple.iCloud.sync.daemon/ $HOME/Library/LaunchAgents/com.geticloud.icloud.photo.plist If any of them exists, it means the malicious Transmission application was executed and that Keydnap is most likely running. Also note that the malicious disk image was named Transmission2.92.dmg while the legitimate one is Transmission-2.92.dmg (notice the hyphen). https://www.welivesecurity.com/2016/08/30/osxkeydnap-spreads-via-signed-transmission-application/ Page 1 of 6 Similarity with KeRanger If this modus operandi sounds familiar, you are totally correct. In March 2016, Palo Alto Networks published a blog post warning about the first OS X ransomware observed. In fact, Keydnap used the same technique to spread itself. In both cases, a malicious block of code is added to the main function of the Transmission application. The code responsible for dropping and running the malicious payload is astonishingly the same. Transmission’s main function dropping OSX/KeRanger https://www.welivesecurity.com/2016/08/30/osxkeydnap-spreads-via-signed-transmission-application/ Page 2 of 6 Transmission’s main function dropping OSX/Keydnap Just like in the KeRanger case, a legitimate code signing key was used to sign the malicious Transmission application bundle. It’s different from the legitimate Transmission certificate, but is still signed by Apple and bypasses Gatekeeper protection. # Malicious Transmission.app $ codesign -dvvv /Volumes/Transmission/Transmission.app Executable=/Volumes/Transmission/Transmission.app/Contents/MacOS/Transmission Identifier=org.m0k.transmission Format=app bundle with Mach-O thin (x86_64) CodeDirectory v=20200 size=6304 flags=0x0(none) hashes=308+3 location=embedded Hash type=sha1 size=20 CandidateCDHash sha1=37ffe70260919ee70e9f2a601d5ad00e2dd5a011 Hash choices=sha1 CDHash=37ffe70260919ee70e9f2a601d5ad00e2dd5a011 Signature size=4255 Authority=Developer ID Application: Shaderkin Igor (836QJ8VMCQ) Authority=Developer ID Certification Authority Authority=Apple Root CA Signed Time=Aug 28, 2016, 12:09:55 PM Info.plist entries=38 TeamIdentifier=836QJ8VMCQ Sealed Resources version=2 rules=12 files=331 Internal requirements count=1 size=212# Clean Transmission.app $ codesign -dvvv /Volumes/Transmission/Transmi https://www.welivesecurity.com/2016/08/30/osxkeydnap-spreads-via-signed-transmission-application/ Page 3 of 6 Executable=/Volumes/Transmission/Transmission.Identifier=org.m0k.transmission Format=app bundle with Mach-O thin (x86_64)CodeDirectory v=20200 size=6304 flags=0x0(noneHash type=sha1 size=20 CandidateCDHash sha1=a68d09161742573b09a17b8aeHash choices=sha1 CDHash=a68d09161742573b09a17b8aef05f918a1cebcaSignature size=8561 Authority=Developer ID Application: **Authority=Developer ID Certification AuthorityAuthority=Apple Root CA Timestamp=Mar 6, 2016, 3:01:41 PM Info.plist entries=38 TeamIdentifier=5DPYRBHEAR Sealed Resources version=2 rules=12 files=328