cocomelonc.github.io · Published 23 Jun
MacOS malware persistence 12: Folder Actions. Simple AppleScript and C example
By cocomelonc
Excerpt
﷽
Hello, cybersecurity enthusiasts and white hackers!
Continuing the macOS malware persistence series. In previous parts we already looked at LaunchAgents , shell environment hijacking, dylib hijacking, Login Items, cron , PAM modules, re-opened applications, periodic , emond , caffeinate , and osascript . Today we look at another old but still interesting macOS-native mechanism: Folder Actions.
This post is based on my macOS Monterey and Sonoma lab idea. Everything here is done in a safe virtual machine. The “malware” is not real malware: it does…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by cocomelonc.github.io on cocomelonc.github.io.
More from cocomelonc.github.io1
cocomelonc.github.io · Web page · Published 27 Apr
MacOS malware persistence 11: osascript LOLBin. Simple C example
Hello, cybersecurity enthusiasts and white hackers! Continuing the macOS malware persistence series. Today we look at another Apple-signed LOLBin: osascript - the command-line interpreter for AppleScript and JavaScript for Automation (JXA). Used in the wild…
On the same topics
Check Point · Web page · Published 27 Mar
Rhadamanthys: The “Everything Bagel” Infostealer
Rhadamanthys is an advanced infostealer which debuted on the dark web in September of last year to a warm critical reception by cybercriminals. A maximalist approach to features: functionality is added for its own sake, never mind the effort required or…
Check Point · Web page · Published 12 Jan
Going Rogue- a Mastermind behind Android Malware Returns with a New RAT
Research by: Aviran Hazum, Alex Shamshur, Raman Ladutska, Ohad Mana, Israel Wernik Introduction Now more than ever, we rely on our smartphones to keep in touch with our work, our families and the world around us. There are over 3.5 billion smartphone users…
Check Point · Web page · Published 10 Dec
Cracking ValleyRAT: From Builder Secrets to Kernel Rootkits
Check Point Research (CPR) presents a full dissection of the widely used ValleyRAT backdoor, also known as Winos/Winos4.0, covering its modular architecture and plugin system. By analyzing the publicly leaked builder and development structure (Visual Studio…
Check Point · Web page · Published 10 Apr
Threat Actors Migrating to the Cloud
Where do malware payloads come from? It’s a question with an apparently trivial answer. Usually these sit on dedicated servers owned by the campaign managers, and occasionally on a legitimate website that has been broken into and commandeered. But, as we were…