Description
EggShell is an open source post exploitation and surveillance tool for macOS and iOS that gives operators access to files, messages, and device location. Penetration testers use it in authorized assessments, and cyberattackers have abused it to spy on targets, so its detections warrant verification against authorized use.
Stats
- First seen
- May 2022
- Last seen
- September 2026
Alert name variants
| Alert Name |
|---|
| Gen:Variant.MAC.EggShell.2 |
| Gen:Variant.Trojan.MAC.EggShell.2 |
| MacOS.Backdoor.EggShell |
| MacOS.Trojan.EggShell |