Loading story…
A macOS persistence demonstration shows that an attacker with root privileges can modify the global /private/etc/man.conf configuration file and set MANPAGER to an attacker-controlled executable. The payload then runs whenever a user invokes the man command, turning the manual-page pager setting into an event-driven execution mechanism.
The proof of concept, tested on macOS Sonoma, compiled a benign C program named meow under /Users/Shared and recorded execution details in /tmp/meow.txt. The method requires privileged access and user interaction rather than providing login-time persistence; no public evidence currently attributes its use to a known malware family or APT group.
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
A macOS Sonoma lab demonstration modified the root-protected global `/private/etc/man.conf` file to set `MANPAGER` to a benign `/Users/Shared/meow` executable. Invoking `man ls` then executed the payload, which logged proof-of-execution details to `/tmp/meow.txt`; the original configuration and test artifacts were subsequently restored or removed.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcegithub.com
Open sourcecocomelonc.github.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A macOS persistence proof of concept showed how **Folder Actions**, a native automation feature, can be abused to trigger code execution whenever files are added to a monitored directory. The demonstration used an AppleScript handler with `on adding folder items` and `do shell script` to launch a benign compiled C payload stored at `/Users/Shared/meow`, which wrote execution details and file paths to `/tmp/meow.txt` instead of performing malicious actions. The technique was tested on macOS Monterey and Sonoma and highlighted that, unlike LaunchAgents, Folder Actions are **event-driven** and execute only when a watched folder receives new items. The workflow included both GUI-based setup and command-line registration through **System Events** and `osascript`, with the caveat that newer macOS versions may require Automation permissions. Defensive guidance focused on monitoring `~/Library/Scripts/Folder Action Scripts`, decompiling `.scpt` files with `osadecompile`, and hunting for suspicious AppleScript patterns such as `do shell script`, unusual watched folders, and process chains involving execution from locations like `/Users/Shared` or `/tmp`.
Jun 29, 2026
Researchers detailed how the **WINDSHIFT** APT group deployed the `OSX.WindTail` implant in cyber-espionage operations against selected individuals tied to Middle Eastern government and critical infrastructure organizations. The malware was delivered through phishing-linked web pages that abused macOS custom URL scheme handling to launch a downloaded application with minimal user interaction, then established persistence by copying itself into `~/Library`, hiding its interface, and adding itself as a login item. The implant generated a unique identifier, searched for documents including `doc`, `docx`, `pdf`, `xls`, `xlsx`, `ppt`, and `txt`, compressed stolen files with `zip`, and exfiltrated them with `curl` to attacker-controlled domains including `string2me.com` and `flux2key.com`. The reporting also highlighted a broader macOS tradecraft pattern in which malware abuses Apple Launch Services registration to gain execution outside traditional launch agents and daemons. Separate analysis of the **Mac File Opener** malware showed how malicious apps can register as handlers for hundreds of file types through `Info.plist`, allowing the operating system to invoke them when users open files and helping them evade security tools focused only on standard persistence artifacts. Together, the cases show attackers exploiting legitimate macOS application registration features, signed apps, and user-driven execution paths to reduce visibility, while defenders are urged to monitor anomalous apps in `~/Library`, suspicious login items, unusual handler registrations, and outbound data theft activity.
Aug 15, 2026
A technical walkthrough demonstrated how **Windows Scheduled Tasks** can be abused to establish malware persistence, using a simple C proof of concept that creates a task named `MeowTask` to launch a payload at user logon with **SYSTEM** privileges and the highest run level. The author initially tested a payload that displayed a message box, then replaced it with one that writes a file after the message box failed to appear following reboot, illustrating how attackers can adapt payload behavior while keeping the persistence mechanism unchanged. The write-up also noted operational quirks during testing, including the task only working in the author’s virtual machine when the laptop was connected to power rather than running on battery. The technique aligns with tradecraft previously associated with threat actors including **APT17** and **APT41**, reinforcing that scheduled task creation remains a practical persistence method defenders should monitor for, particularly unusual or unauthorized tasks that may be detectable or blockable through EDR controls.
Aug 15, 2026