Forest Global Training Partners

Cyber Risks · Cisco Talos

Bad Apples: Weaponizing native macOS primitives for movement and execution

Summary: Cisco Talos researchers documented how native macOS features can be repurposed for lateral movement and code execution, including Remote Application Scripting over the eppc protocol, osascript invoked over SSH, socat listeners that bypass SSH telemetry, and payloads hidden in the Spotlight Finder Comment field. The work also validated SCP, SFTP, SMB, and netcat for tool transfer, and noted that macOS now accounts for over 45 percent of enterprise organizations while MITRE ATT&CK documents far fewer macOS techniques than Windows.

What's compelling: Every technique here runs through tools already on the machine, and the metadata-staging method leaves a LaunchAgent plist with no payload in it, so static analysis of the file reveals nothing. If your detection pipeline is built around SSH logs and process trees, socat and Apple Events-driven actions generate neither.

Read the original at Cisco Talos ↗

Topics
Malware
Related