A trojanized plugin for a widely used infrastructure tool is being used to slip cross-platform backdoors onto developer machines, including Macs, in a campaign researchers link to a state-backed group.
Zscaler ThreatLabz detailed the operation on October 8, describing a fake Amazon Web Services add-on for HashiCorp Terraform that masquerades as a legitimate provider. The team identified it in July 2026 and tied the tooling to suspected TraderTraitor activity, also tracked as Jade Sleet and UNC4899. The firm stopped short of a high-confidence attribution.
The package, named terraform-provider-awsbeta_v1.0.0, behaves normally until Terraform loads it, then runs an added code path. A check for a session.lock file in the temporary directory decides whether a Bash loader runs; the loader plants the lock afterward so it fires only once.
That loader, called safari_updater, profiles the host before choosing a payload. It covers macOS, Linux and Windows, reaching the latter through Unix-like shells such as Cygwin or MSYS. Payloads arrive disguised as .woff web fonts, with decoy font data wrapped around an encrypted executable that the loader unpacks with AES-256-CBC.
The Mac tradecraft is the notable part. Before running its stage, the loader strips the quarantine attribute and applies an ad hoc code signature, a combination that sidesteps Gatekeeper warnings.
What lands is FLATROOF, a Rust backdoor that beacons, runs commands and exfiltrates data. On macOS it targets Safari data and the login.keychain-db file. A second implant, ROOFDECK, adds remote control and finds its server through a signed Pastebin record or Nostr profile metadata.
Because these tools run where source code and cloud keys live, defenders are urged to pin provider checksums in lock files and watch for shell processes spawned by Terraform.
