Cisco Talos documents attack techniques built on native macOS features

Cisco Talos has published research documenting a set of macOS-native living-off-the-land attack techniques. As macOS adoption grows among developers and DevOps teams, the platform has become a valuable target, yet these techniques remain far less documented than their Windows equivalents. Talos shows how Remote Application Scripting can be repurposed for remote execution, and how Spotlight metadata in the form of Finder comments can be used to stage payloads in a way that evades static file analysis. Talos recommends shifting defence from static file scanning towards monitoring process lineage and anomalies in inter-process communication, together with stricter MDM policies that disable unnecessary administrative services.

What this means for your organisation

Many Norwegian organisations have acquired a substantial Mac fleet without their security work keeping pace. Endpoint protection tends to cover the Windows estate, while Macs are governed more loosely because they are "used by developers who know what they are doing". Those are precisely the machines with access to source code and production environments. When attacks leave no files to scan, missing telemetry from the Mac fleet becomes a genuine blind spot.

Berigo recommends

• Bring Macs into security monitoring on equal terms with Windows, with process and network logging.
• Disable administrative remote services that are not in active use, via MDM rather than machine by machine.
• Require that every Mac is genuinely enrolled in central management, including those developers set up themselves.
• Ask your security vendor to account for the coverage they actually provide on macOS.

Source

• blog.talosintelligence.com