2026-09-01 (TUESDAY): ESSENTIAL MACOS STEALER INFECTION

NOTICE:

• Zip files are password-protected.  Of note, this site has a new password scheme.  For the password, see the "about" page of this website.

ASSOCIATED FILES:

• 2026-09-01-Essential-macOS-Stealer-notes.txt.zip   1.0 kB   (996 bytes)
• 2026-09-01-Essential-macOS-Stealer-infection-Build-POMP.pcap.zip   330.7 kB   (330,742 bytes)
• 2026-09-01-Essential-macOS-Stealer-files.zip   12.3 kB   (12,282 bytes)

 

IMAGES

Shown above: Fake macOS software page.

 

Shown above: Text from the fake software page pasted into a macOS Terminal window.

 

Shown above: Traffic from the infection filtered in Wireshark.

 

Shown above: Transaction information on the Polygon blockchain address with C2 server info.

 

Click here to return to the main page.