Phishing Clues Hidden in the /tmp Folder

Summary

A macOS user was deceived by a fake “macOS Protection Service” prompt and entered their password, which triggered deployment of the MacSync infostealer. The malware collected Chrome and Safari cookies, Apple Keychain records, cryptocurrency wallet data, and other local files, staging them under /tmp/salmonela/. The stolen information was then compressed into an archive and exfiltrated with curl to a hidden command-and-control domain before the archive was removed. Huntress detected the intrusion, isolated the endpoint, and stopped the attempted data theft.

Investigation

Huntress SOC identified suspicious activity on the affected Mac involving the native curl binary uploading a ZIP archive. Analysts confirmed the attack relied on LOOBins and attributed the payload to the MacSync infostealer. Containment was achieved by disconnecting the host from the network and deleting the temporary staging folder. Investigators found no signs of additional lateral movement after the endpoint was isolated.

Mitigation

Recommended defenses include training users to spot fake system dialogs, reducing unnecessary local administrator rights, deploying managed EDR on macOS, and rotating credentials after compromise. Restricting unauthorized outbound connections and watching for large uploads through curl can further reduce exposure. Regular auditing and hardening of Keychain access policies adds another protective layer.

Response

If this activity is detected, immediately isolate the endpoint, stop the malicious process, and remove the /tmp/salmonela/ directory. Perform a forensic review to identify any remaining artifacts, reset exposed credentials, and invalidate active sessions. Update detection content to catch similar LOOBin abuse and monitor outbound POST traffic to unfamiliar domains.

Simulation Environment & Context

• TTPs Under Test:

  • T1056.002: Input Capture – Web Forms
  • T1204.004: User Execution – Malicious File
  • T1548.004: Elevation Control Mechanism – Bypass User Access Control
  • T1555.002: Credentials from Web Browsers – Password Extraction
  • T1556.004: Modify Authentication Process – Domain Trust Modification

• TTP Context & Relevance:

  • T1056.002 – The infostealer harvests credentials entered into web forms and stores them in the staging folder.
  • T1204.004 – The malicious binary is executed by a user (often via a disguised installer).
  • T1548.004 – The threat may attempt to run the compression step with elevated privileges to bypass macOS sandboxing.
  • T1555.002 – Extracted browser passwords are written to files under /tmp/salmonela/.
  • T1556.004 – In advanced campaigns the attacker may modify local trust settings before exfiltration, but the rule focuses on the data‑staging activity.

• Target Environment:

  • OS: macOS (Catalina 10.15 or later)
  • Logging: Auditd + FSEvents (file‑event collection) forwarded to a SIEM that consumes Sigma rules.
  • Security Stack: Generic Sigma‑compatible SIEM (e.g., Elastic Stack, Splunk, Microsoft Sentinel).

Telemetry & Baseline Pre‑flight Check

Rationale: Before simulating the attack, we must confirm that the target host is configured to generate the necessary logs, that these logs are ingested by the SIEM, and that the detection rule does not fire on benign activity. Without this validation, any test outcome is unreliable.

• 1. Telemetry Configuration Instructions:

  1. Enable macOS auditd for command‑line logging

     sudo launchctl load -w /System/Library/LaunchDaemons/com.apple.auditd.plist
     sudo audit -s 1                # enable auditing
     sudo audit -f /etc/security/audit_control
     # Ensure "flags:fc,ex" (file create and exec) are present, then restart auditd
     sudo launchctl unload -w /System/Library/LaunchDaemons/com.apple.auditd.plist
     sudo launchctl load -w /System/Library/LaunchDaemons/com.apple.auditd.plist

  2. Enable FSEvents (already on macOS) and forward to SIEM – install the Elastic Filebeat module for macOS or Splunk Universal Forwarder with the fschange input, ensuring path: /tmp/ is included.

  3. Validate ingestion – in the SIEM, run a simple query for any event containing /tmp/ within the last 5 minutes to confirm the pipeline is live.

• 2. Ingestion & Baseline Validation:

  • Action (Benign Telemetry): Create a temporary folder under /tmp and compress it using tar (which does not include the exact trigger phrase).

    # benign command to generate similar telemetry
    mkdir -p /tmp/salmonela_benign
    echo "benign data" > /tmp/salmonela_benign/sample.txt
    tar -czf /tmp/salmonela_benign.tar.gz -C /tmp salmonela_benign

  • Validation Query (Ingestion): (KQL example for Elastic)

    filebeat-* 
    | where file.path contains "/tmp/salmonela_benign"
    | where process.command_line contains "tar"

    The query should return the benign event, confirming that the logs are reaching the SIEM while not matching the detection rule (no “Zipped the contents of salmonela/” string).

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands:

  1. Initial Compromise (T1204.004): The attacker delivers a malicious macOS binary disguised as a legitimate installer. The user executes it, granting the binary process rights to write to /tmp.
  2. Credential Harvesting (T1056.002 & T1555.002): The binary injects a key‑logger into the user’s web browser, captures login forms, and writes the harvested credentials to /tmp/salmonela/creds.txt.
  3. Privilege Escalation Bypass (T1548.004): The binary invokes sudo with a pre‑configured policy that allows it to run the compression step without prompting.
  4. Data Staging & Compression: The attacker runs a bash command that both logs a custom message and zips the staging folder. The exact command line contains the literal string "Zipped the contents of salmonela/", satisfying the Sigma condition.

    sudo bash -c "echo 'Zipped the contents of salmonela/' && zip -r /tmp/salmonela_archive.zip /tmp/salmonela/"

• Regression Test Script: (self‑contained Bash script that reproduces the above actions)

  #!/usr/bin/env bash
  set -euo pipefail
  
  # 1. Prepare staging directory
  STAGE_DIR="/tmp/salmonela"
  mkdir -p "$STAGE_DIR"
  
  # 2. Simulate credential dump
  echo "user:example@example.com" > "$STAGE_DIR/creds.txt"
  echo "pass:SuperSecret123!" >> "$STAGE_DIR/creds.txt"
  
  # 3. Compress with the exact trigger phrase in the command line
  sudo bash -c "echo 'Zipped the contents of salmonela/' && zip -r /tmp/salmonela_archive.zip $STAGE_DIR/"
  
  echo "Simulation complete – alert should fire."

• Cleanup Commands: (removes artifacts and restores the system)

  #!/usr/bin/env bash
  set -euo pipefail
  
  rm -rf /tmp/salmonela
  rm -f /tmp/salmonela_archive.zip
  echo "Cleanup finished."