Tracing Digital Intent: New MacOS Tahoe 26 Artifact Discovered
Summary: Unit 42 researchers identified a new Biome stream in macOS Tahoe 26.x, App.MenuItem, stored at ~/Library/Biome/streams/restricted/App.MenuItem/local, which logs the exact text of menu items a user selects along with timestamps. The file holds SEGB-encapsulated protobuf entries that common commercial forensic tools do not parse, so examiners can use the open-source ccl-segb tool to extract the raw data.
Bottom line: This artifact can turn a bare file-system event into a sequence showing a user deliberately selecting "Move to Trash" and then "Empty Trash" - the difference between knowing a file vanished and showing intent, which is the question that decides an insider-threat or exfiltration case.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026