---
id: 6263
title: "Unmasking SparkRAT: Detection & macOS Campaign Insights"
source_domain: hunt.io
source_url: "https://hunt.io/blog/sparkrat-server-detection-macos-activity-and-malicious-connections"
published_at: "2025-01-28T00:00:00Z"
tags: ["threat-hunting", "macos", "dprk", "rat", "sparkrat", "c2-detection"]
phying_url: "https://phying.com/item/6263"
lang: en
---

# Unmasking SparkRAT: Detection & macOS Campaign Insights

## Summary

Hunt.io details how to spot SparkRAT servers via default port 8000 and HTTP Basic auth banners, and examines a suspected DPRK macOS campaign tied to the Golang RAT's WebSocket C2 traffic.

## Intelligence Metadata

- **Sources:** hunt.io
- **Published:** 2025-01-28T00:00:00Z
- **Original:** https://hunt.io/blog/sparkrat-server-detection-macos-activity-and-malicious-connections
- **Phying News:** https://phying.com/item/6263