← Back to SOC feed Coverage →

It is a simple and easy to use keylogger for macOS written in Swift.

yara LOW signature-base
florian-rothinfostealer
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at signature-base →
Retrieved: 2026-05-28T11:00:00Z · Confidence: medium

Hunt Hypothesis

A SOC team should proactively hunt for this rule as it detects potential keylogging activity on macOS systems, which could indicate unauthorized data exfiltration. The low severity and lack of MITRE techniques suggest the adversary may be using stealthy, custom methods to persist and capture keystrokes, warranting further investigation to identify and mitigate potential breaches.

YARA Rule

rule hacktool_macos_keylogger_skreweverything_swift
{
    meta:
        description = "It is a simple and easy to use keylogger for macOS written in Swift."
        reference = "https://github.com/SkrewEverything/Swift-Keylogger"
        author = "@mimeframe"
        id = "eed3b9bb-e8e4-53b6-8d17-8aa989d8a2fc"
    strings:
        $a1 = "Can't create directories!" wide ascii
        $a2 = "Can't create manager" wide ascii
        $a3 = "Can't open HID!" wide ascii
        $a4 = "PRINTSCREEN" wide ascii
        $a5 = "LEFTARROW" wide ascii
    condition:
        4 of ($a*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 5 string patterns in its detection logic.

References

False Positive Guidance

Original source: https://github.com/Neo23x0/signature-base/blob/main/vendor/yara/airbnb_binaryalert.yar