Proton

ATP Sandbox Adv. HeuristicsAV

Description

Proton is a macOS backdoor that focuses on data theft and credential access on infected machines.

Stats

First seen: May 2022
Last seen: October 2026

MITRE ATT&CK techniques

15 techniques across 8 tactics.

TA0002 Execution

T1059Command and Scripting Interpreter
- T1059.004Unix Shell

TA0003 Persistence

T1543Create or Modify System Process
- T1543.001Launch Agent

TA0004 Privilege Escalation

T1548Abuse Elevation Control Mechanism
- T1548.003Sudo and Sudo Caching

TA0005 Stealth

T1070Indicator Removal
- T1070.004File Deletion
T1140Deobfuscate/Decode Files or Information

TA0006 Credential Access

T1555Credentials from Password Stores
- T1555.001Keychain
- T1555.003Credentials from Web Browsers
- T1555.005Password Managers

TA0008 Lateral Movement

T1021Remote Services
- T1021.005VNC

TA0009 Collection

T1056Input Capture
- T1056.002GUI Input Capture
- T1056.001Keylogging
T1113Screen Capture
T1560Archive Collected Data

TA0112 Defense Impairment

T1685Disable or Modify Tools
- T1685.006Clear Linux or Mac System Logs

Alert name variants

Alert Name	Engine
MacOS.Trojan.Proton	ATP Sandbox Adv. Heuristics
Script-WScript.Trojan.Proton	ATP Sandbox Adv. Heuristics
Trojan.MAC.Proton.N	AV
Win32.Ransomware.Proton	ATP Sandbox Adv. Heuristics
Win64.Ransomware.Proton	ATP Sandbox Adv. Heuristics

Related families

MacMa XLoader Agent Tesla KONNI Machete

References

attack.mitre.org