Netskope Threat Labs

CloudMensis

ATP Sandbox Adv. HeuristicsAV

CloudMensis is a macOS spyware platform documented by ESET researchers, whose later analysis connected it to the ScarCruft threat actor and the RokRAT backdoor used by that group.

First seen
October 2022
Last seen
October 2026
Alert Name
Gen:Variant.MAC.CloudMensis.1
Gen:Variant.Trojan.MAC.CloudMensis.1
MacOS.Trojan.CloudMensis