Loading story…
Palo Alto Networks Unit 42 reported a newly identified forensic artifact in macOS Tahoe 26.x that records user menu selections in Apple’s Biome system. The artifact, named App.MenuItem, is stored at ~/Library/Biome/streams/restricted/App.MenuItem/local and contains SEGB-encapsulated protobuf entries that preserve menu item text and timestamps. According to the report, the data can show deliberate actions taken through the user interface, including saving files, compressing folders, moving items to the trash, and emptying the trash.
The finding gives investigators a new way to reconstruct user intent during incident response and digital forensics, particularly in cases involving suspected data theft or post-activity cleanup. Unit 42 said common commercial forensic tools do not yet parse the stream, but analysts can extract and convert the records for review using the open-source ccl-segb utility. The researchers cautioned that generic menu labels may not identify the exact file or folder involved, so the artifact is most valuable when correlated with other macOS logs and evidence sources.
See real exploitation activity before you spend the cycle.
1 event from the most recent confirmed update back to the earliest known activity.
Unit 42 reported a newly identified macOS Tahoe 26.x forensic artifact in Apple's Biome system called App.MenuItem. The artifact records specific menu selections made by users and can help investigators reconstruct deliberate user actions across the operating system.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
OpenAI’s opt-in **Computer History** feature in the ChatGPT for Mac app uses macOS Accessibility permissions to collect visible text and interaction data—including window titles, typed input, clicks, and application switches—and turn it into diary-like Markdown summaries for contextual assistance and automation. Unlike screenshot-based activity-recording tools, it captures text elements exposed by the operating system; raw events remain local for up to 48 hours before summaries are written to an application-accessible local directory and can be incorporated into ChatGPT conversations. The plaintext summaries may expose sensitive work activity to anyone with local access to the Mac or to macOS-focused infostealer malware, while summaries used in chats can also be retained on OpenAI servers under normal chat and memory policies. Organizations should disable the feature for sensitive roles or tightly scope it, exclude private applications and websites, and enforce strong device login controls and full-disk encryption.
Sep 10, 2026
Researchers detailed how the **WINDSHIFT** APT group deployed the `OSX.WindTail` implant in cyber-espionage operations against selected individuals tied to Middle Eastern government and critical infrastructure organizations. The malware was delivered through phishing-linked web pages that abused macOS custom URL scheme handling to launch a downloaded application with minimal user interaction, then established persistence by copying itself into `~/Library`, hiding its interface, and adding itself as a login item. The implant generated a unique identifier, searched for documents including `doc`, `docx`, `pdf`, `xls`, `xlsx`, `ppt`, and `txt`, compressed stolen files with `zip`, and exfiltrated them with `curl` to attacker-controlled domains including `string2me.com` and `flux2key.com`. The reporting also highlighted a broader macOS tradecraft pattern in which malware abuses Apple Launch Services registration to gain execution outside traditional launch agents and daemons. Separate analysis of the **Mac File Opener** malware showed how malicious apps can register as handlers for hundreds of file types through `Info.plist`, allowing the operating system to invoke them when users open files and helping them evade security tools focused only on standard persistence artifacts. Together, the cases show attackers exploiting legitimate macOS application registration features, signed apps, and user-driven execution paths to reduce visibility, while defenders are urged to monitor anomalous apps in `~/Library`, suspicious login items, unusual handler registrations, and outbound data theft activity.
Aug 15, 2026
Elastic Security Labs reported a suspicious multi-day activity chain on a macOS developer endpoint in which **Claude Code** appeared as the trusted parent process for shells and helper tools that made credentialed HTTP requests, created reverse tunnels, and installed **LaunchAgent** persistence. Telemetry showed `zsh` processes authenticating to ephemeral `localhost[.]run`, `lhr[.]life`, and `trycloudflare[.]com` URLs, collecting application metrics, starting a Cloudflare Quick Tunnel, and writing LaunchAgents to maintain access. Elastic said the behavior could reflect either remote administration of a locally exposed dashboard or a more serious compromise, but noted that detections fired for suspicious web-service connections, suspicious top-level domains, persistence via a GenAI tool, and process discovery. The broader host history also included earlier tunnel and VPN binaries, a suspicious Python script launched from `zsh`, and related coding-agent-parented variants involving **macOS Keychain** access, LOLBin staging, and retrieval of unsigned binaries. The activity aligns with known attacker tradecraft for harvesting credentials from Apple’s Keychain, where passwords, keys, certificates, and other secrets can be accessed through Keychain utilities or direct file access if the user’s Keychain password is available. Elastic advised defenders to treat coding-agent-linked credentialized HTTP activity, reverse tunnels, LaunchAgent persistence, and possible Keychain access as **high-severity** signals even when the tooling involved is legitimate and the use case may be dual-purpose.
Aug 10, 2026