medium
advisory
X-Agent modular backdoor file indicators
Three new file hashes associated with the X-Agent macOS backdoor were identified and added to ThreatFox on November 4, 2026.
Triage facts
Revision 1- Evidence
- Unknown
- Severity
- Medium
- Action
- Elevated
- Sources
- 2 public sources
- Freshness
- Revision 1Nov 5, 13:32 UTC
- Detection
- 2 IOCs
- Source quality
- A1Likely
ThreatFox has reported three new file indicators associated with the X-Agent (OSX) malware family. X-Agent is a modular backdoor historically utilized in espionage campaigns. These indicators are identified as payloads and were first observed on November 4, 2026.
Recommendation
- Ingest the provided SHA-256 and MD5 file hashes into endpoint detection and response (EDR) blocklists.
- Perform retrospective hunting across all managed macOS endpoints for the presence of these file hashes.
- Ensure file integrity monitoring (FIM) is active on critical system paths to detect unauthorized executable deployment.
Immediate actions
Block the listed file hashes on all macOS endpoints
SOC
24h
Threat Hunt
Search for recent file creations or executions matching the identified hash values
high
high confidence
hunt now
Data: EDR telemetry (file_creation, process_start)
Indicators of compromise
1
hash_md5
1
hash_sha256
| Type | Value |
|---|---|
| hash_md5 | 7ededc7f1886835c56a058f3587dc966 |
| hash_sha256 | 30a43e3a64b90e8853daaa61ca5c2a0e6b5f3e7126e47b3ab6d826243e9ca14b |