Loading story…
A macOS persistence proof of concept showed how Folder Actions, a native automation feature, can be abused to trigger code execution whenever files are added to a monitored directory. The demonstration used an AppleScript handler with on adding folder items and do shell script to launch a benign compiled C payload stored at /Users/Shared/meow, which wrote execution details and file paths to /tmp/meow.txt instead of performing malicious actions. The technique was tested on macOS Monterey and Sonoma and highlighted that, unlike LaunchAgents, Folder Actions are event-driven and execute only when a watched folder receives new items.
The workflow included both GUI-based setup and command-line registration through System Events and osascript, with the caveat that newer macOS versions may require Automation permissions. Defensive guidance focused on monitoring ~/Library/Scripts/Folder Action Scripts, decompiling .scpt files with osadecompile, and hunting for suspicious AppleScript patterns such as do shell script, unusual watched folders, and process chains involving execution from locations like /Users/Shared or /tmp.
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
A researcher published a benign proof of concept showing how macOS Folder Actions can be abused for persistence by attaching an AppleScript to a watched folder that launches a C payload when files are added. The post demonstrated the technique on macOS Monterey and Sonoma and included defensive detection ideas such as monitoring Folder Action scripts and decompiling .scpt files.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcecocomelonc.github.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers identified a **ClickFix-style** campaign targeting macOS users that swaps Terminal-based execution for **Script Editor** to bypass newer Apple protections. Victims are lured to fake Apple-themed pages such as “Reclaim disk space on your Mac,” which invoke the `applescript://` URL scheme and open Script Editor with a pre-filled AppleScript. If the user runs it, the script conceals a malicious shell command that decodes a URL, uses `curl` with TLS certificate validation disabled, and pipes the response directly into `zsh` for in-memory execution. The activity, discovered by **Jamf Threat Labs**, ultimately downloads and launches a Mach-O variant of **Atomic Stealer**, an infostealer built to harvest browser credentials, saved passwords, cryptocurrency wallets, and other sensitive data from macOS systems. Researchers said the campaign appears to be an adaptation to Apple’s paste-command scanning protections added in macOS 26.4 for Terminal abuse; while newer macOS versions also warn about unidentified scripts, the attack can still succeed if users follow the prompts. Reported infrastructure tied to the campaign includes `dryvecar.com`, `storage-fixes.squarespace.com`, and `cleanupmac.mssg.me`.
Jun 29, 2026
A macOS persistence demonstration shows that an attacker with root privileges can modify the global `/private/etc/man.conf` configuration file and set `MANPAGER` to an attacker-controlled executable. The payload then runs whenever a user invokes the `man` command, turning the manual-page pager setting into an event-driven execution mechanism. The proof of concept, tested on macOS Sonoma, compiled a benign C program named `meow` under `/Users/Shared` and recorded execution details in `/tmp/meow.txt`. The method requires privileged access and user interaction rather than providing login-time persistence; no public evidence currently attributes its use to a known malware family or APT group.
Sep 15, 2026
A technical walkthrough demonstrated how **Windows Scheduled Tasks** can be abused to establish malware persistence, using a simple C proof of concept that creates a task named `MeowTask` to launch a payload at user logon with **SYSTEM** privileges and the highest run level. The author initially tested a payload that displayed a message box, then replaced it with one that writes a file after the message box failed to appear following reboot, illustrating how attackers can adapt payload behavior while keeping the persistence mechanism unchanged. The write-up also noted operational quirks during testing, including the task only working in the author’s virtual machine when the laptop was connected to power rather than running on battery. The technique aligns with tradecraft previously associated with threat actors including **APT17** and **APT41**, reinforcing that scheduled task creation remains a practical persistence method defenders should monitor for, particularly unusual or unauthorized tasks that may be detectable or blockable through EDR controls.
Aug 15, 2026