Loading story…
A DFIR.ch analysis shows that macOS attackers can abuse built-in zsh modules to conduct network access, file operations, and extended-attribute manipulation inside an existing /bin/zsh process. By loading zsh/net/tcp, an operator can use the ztcp builtin to open a raw TCP connection, retrieve a payload, and execute it from an open socket file descriptor without writing the second stage to disk or launching conspicuous tools such as curl, wget, netcat, rm, or xattr.
The demonstrated chain decodes a Base64-encoded plist, creates a LaunchAgent, and loads it with launchctl for persistence; zsh/attr can also remove the com.apple.quarantine attribute in-process. The technique can bypass detections keyed to process names or command lines, although Apple Endpoint Security and comparable telemetry can still record the underlying network and extended-attribute events as originating from zsh. Defenders should prioritize behavioral detections for network connections, quarantine-attribute removal, persistence creation, and child-process activity rather than alerting solely on named command-line utilities.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
DFIR.ch published a technical analysis demonstrating in-process zsh module abuse for raw-TCP payload retrieval, fileless execution, extended-attribute manipulation, and LaunchAgent persistence. The article recommended behavior-based telemetry, including monitoring quarantine-attribute deletion, rather than process-name-only detections.
ESET documented macOS malware abusing the zsh/net/tcp module to establish a reverse shell. The later DFIR analysis notes this as the known in-the-wild use of the module.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Elastic Security Labs reported a suspicious multi-day activity chain on a macOS developer endpoint in which **Claude Code** appeared as the trusted parent process for shells and helper tools that made credentialed HTTP requests, created reverse tunnels, and installed **LaunchAgent** persistence. Telemetry showed `zsh` processes authenticating to ephemeral `localhost[.]run`, `lhr[.]life`, and `trycloudflare[.]com` URLs, collecting application metrics, starting a Cloudflare Quick Tunnel, and writing LaunchAgents to maintain access. Elastic said the behavior could reflect either remote administration of a locally exposed dashboard or a more serious compromise, but noted that detections fired for suspicious web-service connections, suspicious top-level domains, persistence via a GenAI tool, and process discovery. The broader host history also included earlier tunnel and VPN binaries, a suspicious Python script launched from `zsh`, and related coding-agent-parented variants involving **macOS Keychain** access, LOLBin staging, and retrieval of unsigned binaries. The activity aligns with known attacker tradecraft for harvesting credentials from Apple’s Keychain, where passwords, keys, certificates, and other secrets can be accessed through Keychain utilities or direct file access if the user’s Keychain password is available. Elastic advised defenders to treat coding-agent-linked credentialized HTTP activity, reverse tunnels, LaunchAgent persistence, and possible Keychain access as **high-severity** signals even when the tooling involved is legitimate and the use case may be dual-purpose.
Aug 10, 2026
Research showed that Apple’s built-in `tclsh` interpreter on macOS can be abused as a living-off-the-land binary to fetch and execute shellcode entirely in memory, avoiding normal file-based defenses. The technique relies on `tclsh` entitlements including `com.apple.security.cs.allow-unsigned-executable-memory` and `com.apple.security.cs.disable-library-validation`, which permit unsigned executable memory and loading unsigned dynamic libraries without standard code-signing enforcement; the report also noted that Tcl ships with the `Ffidl` library and HTTP/TLS support, enabling native calls such as `mmap`, `memcpy`, and `mprotect` and remote payload retrieval over HTTPS. The findings indicate that `tclsh` is also listed in XNU hardening exceptions, placing it in a keys-off mode that disables PAC key protections for that identity and potentially lowering barriers for in-memory execution abuse. Apple’s Endpoint Security framework was highlighted as a detection path, because defenders can monitor relevant process and memory-protection activity, including events tied to executable memory allocation and permission changes, to identify suspicious use of `tclsh` for shellcode staging and execution.
Aug 1, 2026
Researchers detailed how the **WINDSHIFT** APT group deployed the `OSX.WindTail` implant in cyber-espionage operations against selected individuals tied to Middle Eastern government and critical infrastructure organizations. The malware was delivered through phishing-linked web pages that abused macOS custom URL scheme handling to launch a downloaded application with minimal user interaction, then established persistence by copying itself into `~/Library`, hiding its interface, and adding itself as a login item. The implant generated a unique identifier, searched for documents including `doc`, `docx`, `pdf`, `xls`, `xlsx`, `ppt`, and `txt`, compressed stolen files with `zip`, and exfiltrated them with `curl` to attacker-controlled domains including `string2me.com` and `flux2key.com`. The reporting also highlighted a broader macOS tradecraft pattern in which malware abuses Apple Launch Services registration to gain execution outside traditional launch agents and daemons. Separate analysis of the **Mac File Opener** malware showed how malicious apps can register as handlers for hundreds of file types through `Info.plist`, allowing the operating system to invoke them when users open files and helping them evade security tools focused only on standard persistence artifacts. Together, the cases show attackers exploiting legitimate macOS application registration features, signed apps, and user-driven execution paths to reduce visibility, while defenders are urged to monitor anomalous apps in `~/Library`, suspicious login items, unusual handler registrations, and outbound data theft activity.
Aug 15, 2026