Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

Observations

What went wrong, and what to do about it

Real breaches, each put through the same four questions: one control that worked, one that did not, one number worth watching, and what should have been done instead. Every entry cites a primary source, because the point of this section is that you can take it to a meeting.

NO. 10/Cross-sector/11 September 2026

Reverse Engineering the Six Stages of MacSync Stealer and RAT

Huntress, 29 July 2026

Huntress recently investigated an incident where the victim searched Google for how to install Claude on a Mac, clicked a sponsored result, and landed on a weaponised claude.ai/share conversation dressed up as an Apple Support install guide. It told them to open Terminal and paste a single curl command. MacSync is a six-stage kill chain, not a smash-and-grab.

What worked

Huntress does not name a control that held here. Read that as a finding in itself: these write-ups are built from what responders actually found, and one with no successes in it is usually describing a network that had none.

What failed

The victim went looking for Claude. Their browser history opens with a Google search for how to install Claude Code on a Mac and, two clicks later, lands on a page that appears to show the answer. In between was an ad, and the ad is the whole trick. The result they clicked was not the organic anthropic.com listing but a paid Google Ads placement. This is malvertising in its current, least exotic form. The term was originally used to describe a booby-trapped banner that launched an exploit when loaded. What it means

The number

2 minutes

Their prefixes are still in the config strings /tmp/openssl-arm64/ and /tmp/openssl-x86_64/, and there are two compile banners rather than one, stamped about 2 minutes apart.

What to do instead

Start with what not to chase. The file hashes and the per-delivery 8-hex identifiers change every build, so they're low-value on their own. Anchor on the behaviours, which don't change: curl -k with a Base64-decoded URL piped into zsh, the loader's execution and its ~/.zshrc persistence.

Sources

Named for the doctrine distinction between a lesson observed and a lesson learned: a lesson is not learned until behaviour has changed and somebody has checked. Pretending otherwise is how the same finding turns up in three consecutive post-incident reports.