Suspicious macOS Coding-Agent Activity Used Tunnels and LaunchAgent Persistence

Elastic Security Labs reported a suspicious multi-day activity chain on a macOS developer endpoint in which Claude Code appeared as the trusted parent process for shells and helper tools that made credentialed HTTP requests, created reverse tunnels, and installed LaunchAgent persistence. Telemetry showed zsh processes authenticating to ephemeral localhost[.]run, lhr[.]life, and trycloudflare[.]com URLs, collecting application metrics, starting a Cloudflare Quick Tunnel, and writing LaunchAgents to maintain access. Elastic said the behavior could reflect either remote administration of a locally exposed dashboard or a more serious compromise, but noted that detections fired for suspicious web-service connections, suspicious top-level domains, persistence via a GenAI tool, and process discovery.

The broader host history also included earlier tunnel and VPN binaries, a suspicious Python script launched from zsh, and related coding-agent-parented variants involving macOS Keychain access, LOLBin staging, and retrieval of unsigned binaries. The activity aligns with known attacker tradecraft for harvesting credentials from Apple’s Keychain, where passwords, keys, certificates, and other secrets can be accessed through Keychain utilities or direct file access if the user’s Keychain password is available. Elastic advised defenders to treat coding-agent-linked credentialized HTTP activity, reverse tunnels, LaunchAgent persistence, and possible Keychain access as high-severity signals even when the tooling involved is legitimate and the use case may be dual-purpose.