macOS Phishing Campaign Uses AppleScript to Steal Credentials and Abuse TCC
Summary
Researchers detail a macOS phishing campaign that uses AppleScript to steal credentials, attempt to forge TCC permissions, and install a persistent Node.js loader. TCC manipulation may fail on newer macOS versions.
Key points
- A phishing email delivers an AppleScript disguised as a Microsoft document and prompts the recipient to run it.
- The script downloads another AppleScript that displays a fake system-password prompt and sends captured credentials to command-and-control infrastructure.
- The malware attempts to forge TCC permissions for trusted Apple-signed binaries, potentially enabling access to protected resources without consent prompts.
- A Node.js loader profiles the system, communicates with the C2 server, and can retrieve additional payloads.
- A LaunchAgent provides persistence, while a JavaScript command loop checks for commands and payloads.
- The researchers say TCC manipulation may work on some older macOS systems but is likely to fail on newer versions with stronger integrity checks; MDM profiles can also override TCC settings.
- The article provides domains, an IP address, URLs, and file hashes as indicators of compromise.
Article Details
- Attack Vectors
- A phishing email prompts macOS users to download and open an AppleScript file disguised as a Microsoft document.
- The AppleScript uses social engineering to persuade the user to run it, then retrieves further scripts from C2 infrastructure.
- A retrieved script presents a fake system-password dialog and sends entered credentials to the C2.
- The scripts attempt to manipulate the macOS TCC database to grant permissions to trusted Apple-signed binaries, then use those binaries to perform actions.
- A Node.js loader profiles the system, communicates with the C2 for further payloads, and establishes persistence using a LaunchAgent.
- Defensive Notes
- Keep macOS fully updated. The article reports that newer macOS safeguards move authorization enforcement into the tccd daemon and add integrity checks that can prevent this TCC database manipulation.
- The article says TCC database reload manipulation may still succeed on some older operating systems, while MDM profiles override TCC.
- The malware requires user interaction to execute its initial AppleScript.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | sevrrhst[.]com | C2 domain used to retrieve scripts and payloads and receive credentials and victim-system data. |
| IPV4 | 88[.]119[.]171[.]59 | Listed in the article's Indicators of Compromise section as an indicator for the campaign. |
| MD5 | 319d905b83bf9856b84340493c828a0c | MD5 listed for the malicious AppleScript file Investor Profile (Japan-based) - Shiro Arai.pdf.scpt. |
| MD5 | 94b7392133935d2034b8169b9ce50764 | MD5 listed for the malicious AppleScript file EDD_Questionnaire_Individual_Blank_Form.docx.scpt. |
| MD5 | d3539d71a12fe640f3af8d6fb4c680fd | MD5 listed for the malicious AppleScript file Confirmation_Token_Vesting.docx.scpt. |
| URL | hxxps[:]//sevrrhst[.]com/inc/register[.]php?req=next | C2 URL used by the final payload loader to retrieve a Base64-encoded binary. |
| URL | hxxps[:]//stomcs[.]com/inc/register[.]php?req=next | Listed in the article's Indicators of Compromise section as a campaign URL. |
MITRE ATT&CK
T1036.005 · Match Legitimate Resource Name or LocationThe initial AppleScript filename is made to resemble a legitimate Microsoft document.T1057 · Process DiscoveryThe loader gathers information about running processes.T1059.002 · AppleScriptThe user is prompted to run an AppleScript that downloads and executes further scripts.T1059.004 · Unix ShellThe scripts use shell commands, including curl, killall, and dscl, during the infection chain.T1059.007 · JavaScriptJavaScript files, including index.js, default.js, and addon.js, profile the system, maintain a command loop, and load payloads.T1082 · System Information DiscoveryThe JavaScript loader collects operating-system platform and version, CPU, memory, disk, and network-interface details.T1105 · Ingress Tool TransferThe scripts retrieve additional scripts, a Node archive, dependencies, a LaunchAgent plist, and a further binary from the C2.T1140 · Deobfuscate/Decode Files or InformationBase64-encoded scripts and a binary are decoded before use.T1222.002 · Linux and Mac PermissionsThe script attempts to rename the TCC directory and modify TCC database entries.T1547.001 · Registry Run Keys / Startup FolderA downloaded LaunchAgent plist launches node and default.js automatically.T1553.006 · Code Signing Policy ModificationThe script gathers code-signing requirements and forges csreq trust objects for trusted binaries as part of its attempted TCC authorization manipulation.T1566 · PhishingThe infection begins with a phishing email delivering an AppleScript file.
People
Vendors
Products
macOSDarktrace security researchers have identified a campaign targeting macOS users through a multistage malware campaign that leverages social engineering and attempted abuse of the macOS Transparency, Consent and ControlNode.jsThe malware establishes persistence via LaunchAgents and deploys a modular Node.js loader capable of executing binaries delivered from a remote command-and-control (C2) server.TCCthat leverages social engineering and attempted abuse of the macOS Transparency, Consent and Control (TCC) privacy feature.
Tools
AppleScriptThe infection chain starts with a phishing email that prompts the user to download an AppleScript file named “Confirmation_Token_Vesting.docx.scpt”, which attemps to masquerade as a legitimate Microsoft document.codesignchooses from trusted Mac applications: Finder, Terminal, Script Editor, osascript, and bash. Using the codesign command codesign -d --requirements, it extracts the designated code-signing requirement from the targetcsreqis gathered, it is then compiled into a binary trust object using the Code Signing Requirement command (csreq). This trust object is then converted into hex so it can later be injected into the TCC SQLite database.