Traffic inside I2P doesn’t interact with the Internet directly and uses encrypted unidirectional tunnels between anonymous peers. I2P describes itself as “a fully encrypted private network layer protects your activity and location…No one can see where traffic is coming from, where it is going, or what the contents are.” Honkbox is the first known macOS malware to make use of I2P, which in effect functions as an alternative to the better known TOR/Onion router for hiding internet traffic and content. Honkbox has been circulating since at least 2019 and was likely first spotted in the wild by a reddit user questioning why what appeared to be Apple software was tripping over the macOS firewall.Īs the research by Jamf and previously by Trend Micro on one of the earlier variants described, is in fact a masquerade for the I2P command line tool. Many of the samples originate from trojanized versions of Logic Pro, but other popular creative applications have been abused including Adobe Zii, Photoshop, Illustrator and Ableton Live. The malware has been distributed on the PirateBay in cracked apps for at least three years by user wtfisthat34698409672. Honkbox is a multistage cryptominer with three identified variants that make novel use of the I2P project. XProtect update v2166 includes three signatures for Honkbox Apple’s YARA rules dubbed the malware ‘Honkbox’ ( aka HONKBOX, but we’ll spare your eyes).

The new signatures departed from Apple’s recent practice and used human-readable malware names instead of their usual short base 16 strings. In this post, we describe Honkbox from a threat hunter’s point of view, providing a comprehensive breakdown of file characteristics, unique behavior and sample hashes that analysts and SOC teams can ingest to further aid their detection and response.Īpple updated XProtect last week in light of a publication by researchers at Jamf describing a known but relatively undocumented macOS malware. Honkbox is an active threat with at least three variants and multiple components, some of which have not been previously documented. Apple’s update comes on the back of new research from Jamf, which itself builds on earlier research from other sources. Version 2166 added several new signatures for a threat it labels “Honkbox”, a cryptominer characterized by its leverage of XMRig and the “Invisible Internet Project” ( aka I2P). For the first time since November 2022, Apple last week released an update to its internal YARA-based malware file blocking service, XProtect.

Adobe zii latest version