cyber.hendryadrian.com
Security News · huntress.com

Huntress Makes Its macOS Security Agent Generally Available

· Original article ↗

Summary

Huntress announced general availability of its macOS agent, initially focused on detecting persistence. The company says test deployments detected Bundlore and outlines common macOS infection vectors and LaunchAgent persistence.

Key points

  • Huntress made its macOS agent generally available to customers with a Huntress account.
  • The agent initially focuses on detecting persistence, including malware that uses LaunchAgents and plist files.
  • The article lists phishing, trojanized applications, malicious URLs, supply-chain attacks, remote services and exploits among macOS infection vectors.
  • Huntress says test deployments detected Bundlore, which it describes as macOS adware.
  • The company said it planned to expand remediation capabilities and endpoint visibility.

Article Details

Event Type
Huntress announced the general availability of its macOS agent, with initial capabilities focused on detecting persistence.
Impact
Huntress customers can use the macOS agent to monitor endpoints for malware persistence, particularly LaunchAgent-based persistence. Huntress reported detecting Bundlore during customer test deployments. The article describes common macOS infection vectors and persistence examples but reports no broader incident or customer impact.

MITRE ATT&CK

T1543.001 · Launch AgentThe article describes malware persisting by creating LaunchAgent plist files.

People

Jamie LevyAuthor of the article announcing Huntress macOS agent general availability.MollyHuntress ThreatOps team member who analyzed a Bundlore sample detected during agent test deployments.Patrick WardleResearcher cited for prior work on macOS infection vectors and for finding a zero-day in Zoom.

Malware

BundloreWe’ve had several macOS agents deployed in test runs across some customers and have managed to already detect malware. One example we’ve found during this time is Bundlore.CodeSpyCodeSpy~/Library/Launchagents/com.apple.appstore.checkupdate.plist orShlayerin general—for example, by choosing to masquerade as common Windows programs like Adobe Flash Player, as Shlayer did within the last year. Windows users are used to having to update software like Adobe Flash Player orSysJokerSysJoker/Library/LaunchAgents/com.apple.update.plistElectroRat~/Library/LaunchAgents/

Vendors

HuntressWith macOS malware continuing to ramp up, it’s become clear that a macOS agent is our next logical step with our next iteration of The Huntress Managed Security Platform.

Products

Adobe Flash Playerwith macOS in general—for example, by choosing to masquerade as common Windows programs like Adobe Flash Player, as Shlayer did within the last year. Windows users are used to having to update software likeHuntress macOS agentthe steady growth of the macOS platform, we defenders must be ready. With this, we are putting our Huntress macOS agent into General Availability! This means anyone with a Huntress account has access to it.Huntress Managed Security PlatformWith macOS malware continuing to ramp up, it’s become clear that a macOS agent is our next logical step with our next iteration of The Huntress Managed Security Platform.macOSmacOS Support Is Here!Safariadvantage of users’ unfamiliarity with macOS features is by crafting malicious URLs that may result in Safari automatically processing the files. Users may be unaware of this default setting of Safari. As a result,Zoomcould allow an attacker to wreak havoc on the machine. Patrick Wardle found a rather interesting 0-day in Zoom back in August, which is even more relevant in today’s age of working from home. You can see how important

Related Articles