Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Lateral Movement on macOS: Unique and Popular Techniques and In-the-Wild Examples

Summary: Unit 42's report details macOS lateral movement techniques including theft and reuse of SSH keys, abuse of Apple Remote Desktop, and Remote Apple Events over the EPPC protocol on TCP port 3031. It cites in-the-wild examples: the 2021 ZuRu malware that trojanized iTerm2, SecureCRT and Navicat to steal .ssh directory contents, the December 2022 PyTorch dependency confusion attack via the torchtriton package, the SSH-Snake worm, and the Insekt malware served by the Alchemist framework that adds attacker keys to authorized_keys.

Why it matters: Attackers who reach one Mac can reuse its SSH keys and native management tools like ARD and Remote Apple Events to move across the fleet while blending in with legitimate admin activity, so a single compromised host can expose every machine those credentials and tools reach.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Detection & Response
Related
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026