huntress.comwriteupSomething Phishy in the /tmp Folder
Huntress's AI-Centric SOC details an incident where a user was tricked by a fake "macOS Protection Service" pop-up into entering their password, launching the MacSync infostealer. MacSync harvested Apple Keychain credentials, Chrome/Safari cookies, 200+ crypto wallets, and documents into /tmp/salmonela/, zipped the loot, and used curl to POST it to a C2 server before Huntress Managed EDR flagged the LOOBins-based activity, isolated the host, and stopped exfiltration.
TL;DR A fake macOS "protection" prompt tricked a user into unlocking Keychain for the MacSync infostealer, which Huntress EDR caught and killed before it could exfiltrate stolen credentials and crypto wallets via curl to a C2 server.
Organisations named here
- LOOBins
Technologies named here
- macOS
- Huntress Managed EDR
- Apple Keychain
- Huntress AI-Centric SOC
- curl
- Chrome
- Safari
- Huntress agentic security platform
- EDR
- Huntress
Techniques named here
- Social engineering via fake system prompt
- Credential and data theft
- Local staging of stolen data
- Data exfiltration via C2
- Anti-forensic cleanup
- Living off the orchard binaries
Threat actors named here
- MacSync
Related in Threat Intel
huntress.comwriteupReverse Engineering the Six Stages of MacSync Stealer and RAT
huntress.comwriteupAI-Coded Malware | Analyzing Vibe-Coded AD Enumeration | Huntress
blog.talosintelligence.comtoolIntroducing CAIRN: Frontier tracking for AI-integrated malware (Cisco Talos)
huntress.comwriteup