Contagious Interview Moves Outside Traditional Developer Workflows

Summary

Jamf Threat Labs identified a macOS malware campaign that uses trojanized disk images and installer packages to deliver OtterCookie malware. Attackers rely on fake job interview lures to convince developers to execute malicious code through modified application bundles or installer scripts. The infection chain uses staging infrastructure to deploy multiple payload components, including a remote access trojan and credential stealer.

Investigation

The investigation revealed a multi-stage execution chain beginning with modified Info.plist files inside macOS application bundles and PKG installers. Analysts identified Go-compiled shell scripts and the Bunster tool being used to support malware deployment. Researchers also traced the infrastructure to a staging server and a separate operator-controlled server associated with OtterCookie.

Mitigation

Users should avoid downloading or running unsigned applications or software lacking proper notarization from untrusted sources. Organizations can use Jamf for Mac to apply advanced threat controls and web protection capable of blocking malicious execution. Manually removing the com.apple.quarantine attribute should also be treated as high-risk activity.

Response

If malicious activity is detected, the affected macOS endpoint should be isolated immediately to prevent additional data exfiltration or lateral movement. Responders should conduct a full forensic investigation to determine the initial delivery vector, including compromised Git repositories or fake job assignments. Systems should also be checked for unauthorized Node.js processes and suspicious files within the ~/.task directory.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary aims to gain initial access by tricking a user into running a fake macOS installer. The malware, disguised as a legitimate utility, installs itself into a hidden directory /task/mac/ to avoid casual inspection. Once the user executes the “installer,” it invokes the Bunster process to run a secondary shell script that establishes persistence. This specific combination of a non-standard path and the Bunster process name is what the detection rule is designed to catch.

• Regression Test Script:

  #!/bin/bash
  # Simulation script for macOS Fake Installer Malware Activity
  
  # 1. Create the suspicious directory structure
  sudo mkdir -p /task/mac/
  
  # 2. Create a dummy 'Bunster' binary
  # In a real attack, this would be a functional malicious binary.
  echo "#!/bin/bash" > /task/mac/Bunster
  echo "echo 'Malicious payload executing...'" >> /task/mac/Bunster
  chmod +x /task/mac/Bunster
  
  # 3. Execute the 'Bunster' process from the suspicious path to trigger the rule
  echo "[*] Triggering detection rule..."
  /task/mac/Bunster
  
  echo "[*] Simulation complete."

• Cleanup Commands:

  # Remove the simulated malware directory and binary
  sudo rm -rf /task/mac/