Loading story…
Research showed that Apple’s built-in tclsh interpreter on macOS can be abused as a living-off-the-land binary to fetch and execute shellcode entirely in memory, avoiding normal file-based defenses. The technique relies on tclsh entitlements including com.apple.security.cs.allow-unsigned-executable-memory and com.apple.security.cs.disable-library-validation, which permit unsigned executable memory and loading unsigned dynamic libraries without standard code-signing enforcement; the report also noted that Tcl ships with the Ffidl library and HTTP/TLS support, enabling native calls such as mmap, memcpy, and mprotect and remote payload retrieval over HTTPS.
The findings indicate that tclsh is also listed in XNU hardening exceptions, placing it in a keys-off mode that disables PAC key protections for that identity and potentially lowering barriers for in-memory execution abuse. Apple’s Endpoint Security framework was highlighted as a detection path, because defenders can monitor relevant process and memory-protection activity, including events tied to executable memory allocation and permission changes, to identify suspicious use of tclsh for shellcode staging and execution.
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
A blog post described how Apple's built-in Tcl interpreter on macOS Tahoe can be abused as a living-off-the-land binary to allocate executable memory, fetch payloads over HTTPS, and execute shellcode in memory using the preinstalled Ffidl library. The post also highlighted relevant detection opportunities via macOS Endpoint Security API mmap and mprotect events and noted tclsh's hardening exceptions and entitlements.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A DFIR.ch analysis shows that macOS attackers can abuse built-in zsh modules to conduct network access, file operations, and extended-attribute manipulation inside an existing `/bin/zsh` process. By loading `zsh/net/tcp`, an operator can use the `ztcp` builtin to open a raw TCP connection, retrieve a payload, and execute it from an open socket file descriptor without writing the second stage to disk or launching conspicuous tools such as `curl`, `wget`, `netcat`, `rm`, or `xattr`. The demonstrated chain decodes a Base64-encoded plist, creates a LaunchAgent, and loads it with `launchctl` for persistence; `zsh/attr` can also remove the `com.apple.quarantine` attribute in-process. The technique can bypass detections keyed to process names or command lines, although Apple Endpoint Security and comparable telemetry can still record the underlying network and extended-attribute events as originating from zsh. Defenders should prioritize behavioral detections for network connections, quarantine-attribute removal, persistence creation, and child-process activity rather than alerting solely on named command-line utilities.
Sep 18, 2026
Elastic Security Labs reported a suspicious multi-day activity chain on a macOS developer endpoint in which **Claude Code** appeared as the trusted parent process for shells and helper tools that made credentialed HTTP requests, created reverse tunnels, and installed **LaunchAgent** persistence. Telemetry showed `zsh` processes authenticating to ephemeral `localhost[.]run`, `lhr[.]life`, and `trycloudflare[.]com` URLs, collecting application metrics, starting a Cloudflare Quick Tunnel, and writing LaunchAgents to maintain access. Elastic said the behavior could reflect either remote administration of a locally exposed dashboard or a more serious compromise, but noted that detections fired for suspicious web-service connections, suspicious top-level domains, persistence via a GenAI tool, and process discovery. The broader host history also included earlier tunnel and VPN binaries, a suspicious Python script launched from `zsh`, and related coding-agent-parented variants involving **macOS Keychain** access, LOLBin staging, and retrieval of unsigned binaries. The activity aligns with known attacker tradecraft for harvesting credentials from Apple’s Keychain, where passwords, keys, certificates, and other secrets can be accessed through Keychain utilities or direct file access if the user’s Keychain password is available. Elastic advised defenders to treat coding-agent-linked credentialized HTTP activity, reverse tunnels, LaunchAgent persistence, and possible Keychain access as **high-severity** signals even when the tooling involved is legitimate and the use case may be dual-purpose.
Aug 10, 2026
Researchers at XM Cyber disclosed a macOS privilege-escalation technique that allows a standard, non-administrative user to disable enterprise security software and invoke privileged functions without administrator credentials or kernel exploits. The attack chain abuses legitimate macOS behavior by combining weakly validated XPC connections, malicious payload injection into Interface Builder NIB files, and a newly described misuse of the kernel code-signing trust cache, which can continue trusting an application's `CDHash` after a legitimately signed app has run. XM Cyber said it successfully used the method to silently unload or permanently deactivate **CrowdStrike Falcon Sensor**, **Kandji MDM**, and a third unnamed EDR product without triggering alerts. Kandji addressed the issue in an updated agent release and assigned **`CVE-2026-39118`**, CrowdStrike reportedly paid a bug bounty and added detections while disclosure continues, and another vendor is developing a patch; XM Cyber also warned that Apple does not plan to remediate the underlying macOS design issue, leaving software vendors to implement their own mitigations.
Jun 29, 2026