Loading story…
Elastic Security Labs reported a suspicious multi-day activity chain on a macOS developer endpoint in which Claude Code appeared as the trusted parent process for shells and helper tools that made credentialed HTTP requests, created reverse tunnels, and installed LaunchAgent persistence. Telemetry showed zsh processes authenticating to ephemeral localhost[.]run, lhr[.]life, and trycloudflare[.]com URLs, collecting application metrics, starting a Cloudflare Quick Tunnel, and writing LaunchAgents to maintain access. Elastic said the behavior could reflect either remote administration of a locally exposed dashboard or a more serious compromise, but noted that detections fired for suspicious web-service connections, suspicious top-level domains, persistence via a GenAI tool, and process discovery.
The broader host history also included earlier tunnel and VPN binaries, a suspicious Python script launched from zsh, and related coding-agent-parented variants involving macOS Keychain access, LOLBin staging, and retrieval of unsigned binaries. The activity aligns with known attacker tradecraft for harvesting credentials from Apple’s Keychain, where passwords, keys, certificates, and other secrets can be accessed through Keychain utilities or direct file access if the user’s Keychain password is available. Elastic advised defenders to treat coding-agent-linked credentialized HTTP activity, reverse tunnels, LaunchAgent persistence, and possible Keychain access as high-severity signals even when the tooling involved is legitimate and the use case may be dual-purpose.
Get the actors, campaigns, and ATT&CK mapping behind it.
13 events from the most recent confirmed update back to the earliest known activity.
The session executed process discovery helpers such as pgrep to check related workloads, and Elastic noted related coverage from its Process Discovery via Built-In Applications detection.
The agent-parented session wrote and loaded LaunchAgent persistence using PlistBuddy and launchctl bootstrap, including watchdog and tunnel-keeper style agents configured with StartInterval and liveness checks. Elastic's Persistence via GenAI Tool rule fired on this behavior.
Elastic Defend raised a malicious_file event on an ngrok binary in the project tree. The earliest detection in the July 23 window appeared under a zsh parent, with later related activity under launchd.
The same July 23 session started cloudflared to publish a localhost service through Cloudflare Quick Tunnels and contacted api.trycloudflare[.]com as part of the reverse-tunnel setup. Elastic's suspicious web service detection fired on this activity.
zsh processes under Claude Code made credentialed HTTP(S) requests to ephemeral lhr[.]life hosts associated with localhost[.]run, polling a /login endpoint, posting credentials, and requesting application summary data. Elastic noted credentials appeared in process command lines during this tunnel-authentication stage.
Telemetry showed Claude Code sessions launched with --allow-dangerously-skip-permissions, reducing approval prompts for subsequent tool execution during the suspicious activity.
On July 23, two hunt paths converged on the same macOS host: one driven by VirusTotal reputation on a contacted domain and another by correlated endpoint behavior alerts.
Elastic recorded a spike in GenAI or MCP Server Child Process Execution alerts on the developer endpoint, indicating increased suspicious activity tied to coding-agent-parented processes.
The host showed a write to ~/.claude/projects/*/memory/MEMORY.md performed by cat rather than by the Claude process, indicating unusual manipulation of Claude project memory data.
Elastic observed zsh spawning python3 /tmp/mcp_clean_landers.py with an outbound HTTPS connection to a redacted domain. The activity appeared to use JSON-RPC-style MCP analytics requests to retrieve data rather than obviously exfiltrate data.
Elastic observed malicious_file detections on tunnel/VPN-class binaries including pritunl-client and later wireguard-go on the monitored macOS developer endpoint, marking the start of the suspicious activity chain.
MITRE ATT&CK published its Enterprise sub-technique entry T1555.001 describing how adversaries can obtain credentials from the macOS Keychain, including use of the security utility and direct access to keychain files.
Elastic reported additional coding-agent-parented variants on other hosts, including Apple-signed Python and osascript dropping JavaScript under /tmp, a Cursor-related attempt to dump decrypted keychain material for Linear and MCP OAuth, and a Claude Code variant that downloaded an unsigned binary over plaintext HTTP and probed ~/.zshenv for persistence.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
4 references tracked. Mallory keeps watching after this page renders.
cyberaccord.com
Open sourcecybersecuritynews.com
Open sourceelastic.co
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported that AI coding agents are increasingly setting off endpoint detections because their routine actions resemble attacker tradecraft on both macOS and Windows systems. Hunt & Hackett described a macOS investigation in which a shell process ran ```bash security dump-keychain -a ``` and filtered the results for a Bitbucket API token, initially appearing to be credential theft before investigators tied the activity to a legitimate developer using an AI-assisted coding environment. Sophos separately observed Windows telemetry showing agents such as **Claude Code**, **Cursor**, **OpenAI Codex**, and tools built on **GStack** triggering detections associated with **Credential Access** and **Execution**, including DPAPI-based browser credential decryption, Python access to browser credential stores, and `cmdkey.exe` enumeration of Windows Credential Manager entries. The reported activity also included repeated LOLBin-based download attempts using trusted utilities and at least one blocked startup-folder persistence attempt linked to Cursor, underscoring how benign agent behavior can overlap with high-confidence intrusion signals. Researchers said the observed cases were not malicious, but warned that autonomous agents, weak logging of intent, prompt-injection risk, and permissive settings such as Claude Code's dangerous no-approval mode can turn similar workflows into genuine incidents. They recommended treating AI agents as a new execution layer with **least privilege**, isolation, stronger approvals for sensitive actions, and continued strict monitoring of credential-store access rather than broadly suppressing detections.
Jul 12, 2026
An exposed staging environment uncovered by CloudSEK revealed a financially motivated, Chinese-speaking threat operator using multiple AI coding agents as an autonomous offensive platform to support cryptocurrency theft and mass compromise operations. Files in the open directory documented two campaigns running from 10 July to 28 July 2026: opportunistic WordPress exploitation for cryptojacking and targeted intrusions against cryptocurrency and DeFi organizations. The leaked workspace contained more than **12,000** WordPress backdoor records, **66** harvested administrator credential sets, a reconnaissance corpus covering **3.4 million** hosts, live API keys and admin tokens, and stolen cryptocurrency wallet private keys and seed phrases. CloudSEK said the operator managed agents through Telegram, disabled approval safeguards, and reused a fake Chinese-language "authorized pentest" jailbreak prompt to drive offensive actions, while also developing a blockchain-based `DeadDropC2` framework that appeared to remain in local testing. A separate exposed repository on `45.61.136.49` showed the same broader pattern of openly accessible attacker infrastructure, this time serving macOS malware through downloader scripts named **Chrome**, **claude**, and **codex**. Those scripts retrieved a Mach-O universal binary called `codexclod`, cleared macOS quarantine attributes, made the file executable, and launched it, suggesting a delivery chain designed to lure Apple users with trusted software and AI-brand filenames. Investigators found no victim databases or proprietary documents in that repository, but the staging setup reinforced how misconfigured attacker infrastructure can expose active payload delivery, tooling, and operational tradecraft tied to credential compromise and crypto-focused theft.
Aug 20, 2026
Researchers reported multiple social-engineering campaigns targeting macOS users with **fake CAPTCHA** and **ClickFix** lures that trick victims into copying and pasting malicious commands into Terminal, shifting execution to the user and bypassing traditional app-download protections. One campaign delivered **Atomic macOS Stealer (AMOS)** through trojanized cracked applications and malicious Terminal instructions, stealing credentials, browser data, cryptocurrency wallets, Telegram data, VPN profiles, keychain contents, Apple Notes, and files from common user folders before compressing and exfiltrating them over HTTP/HTTPS. Trend Micro separately documented multistage fake CAPTCHA attacks that also led to infostealers and remote-access trojans, underscoring the broader use of human-verification themes to launch malware chains. A separate July 2026 macOS campaign used a fake **TrustKey** verification page on Cloudflare Pages, a Cloudflare Worker, and an AppleScript-based loader to install a persistent backdoor named **`bmodule`** via LaunchAgent persistence. The malware dynamically resolved live command-and-control infrastructure from a **Polygon** smart contract using an **EtherHiding** technique, then fingerprinted hosts, phished macOS login passwords, and fetched tasks to deploy AMOS variants, an interactive shell, or an **XMRig** cryptominer. Apple said **macOS Sequoia** has updated runtime protections, while incident reporting shows Terminal-based social-engineering chains remain effective because they rely on users to execute the malicious commands directly.
Aug 28, 2026