Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
1 IOC
Macos Malware Persistence 12: Folder Actions. Simple Applescript and C Example
Threat Actors
Excerpt
https://cocomelonc.github.io/macos/2026/06/23/mac-malware-persistence-12.html MacOS malware persistence 12: Folder Actions. Simple AppleScript and C example By cocomelonc Published: 2026-06-23 · Archived: 2026-10-27 02:20:01 UTC ﷽ Hello, cybersecurity enthusiasts and white hackers! Continuing the macOS malware persistence series. In previous parts we already looked at LaunchAgents , shell environment hijacking, dylib hijacking, Login Items, cron , PAM modules, re-opened…
Read the original report →Diamond Model
Adversary(1)
Infrastructure(1)
Capability
Victim
Indicators of Compromise
Open the mindmap →1 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| URL | https://cocomelonc.github.io/macos/2026/06/23/mac-malware-persistence-12.html | High | Score 67/100 | First seen |
IOC Relationship Graph
Building graph…