Mispadu

Detection: MacOS Osascript Displaying Suspicious User Prompt | Splunk Security Content

Splunk Enterprise Security released an anomaly analytic to identify suspicious macOS osascript executions that invoke AppleScript display alert or display dialog commands using credential- or security-themed wording. Such dialogs can impersonate macOS authentication or security notices and trick users into disclosing passwords and other sensitive data, a technique tracked as MITRE ATT&CK T1056.002 (GUI Input Capture). The detection uses osquery process telemetry, maps the execution mechanism to T1059.002 (AppleScript), and generates intermediate risk events rather than notable findings; it is disabled by default. osascript is a legitimate native macOS utility but can also execute AppleScript or JavaScript for Automation to collect clipboard or system data, manipulate applications, and present fake authentication prompts, so alerts require investigation to distinguish malicious activity from legitimate MDM, deployment, support, and automation scripts.

DinDoor, DenoRAT, and NightshadeC2: Analyzing TAG-150's Evolving Tradecraft | eSentire

eSentire reported that a June 2026 intrusion against a finance-sector customer began with a ClickFix-style social engineering lure that triggered a malicious command, an MSI installer, and a multi-stage malware chain attributed to TAG-150. The infection sequence used an apparently AI-generated PowerShell script, Griffin20.ps1, to install the Deno runtime and launch the Deno-based loader DinDoor, which then deployed DenoRAT and ultimately NightshadeC2. Investigators said the malware communicated with command-and-control infrastructure including webstizkgao[.]com and used hard-coded JWTs carrying campaign identifiers such as buildId 0def066f14754be9 and buildNote LearnV7msi. The tooling provided broad post-compromise capability, with DenoRAT functioning as a RAT, loader, and stealer that supported command execution, persistence, host fingerprinting, file operations, screenshots, PTY and VNC-style remote control, and theft from browsers and cryptocurrency wallets. eSentire said the malware could also bypass Chromium App-Bound Encryption through DLL injection, a technique widely associated with in-memory execution, evasion, and abuse of legitimate Windows processes in ATT&CK T1055.001. The final NightshadeC2 payload was delivered through a PowerShell-driven Python in-memory loader, decrypted from an encrypted container using AES-256-CBC with a key derived from MoscauHighSmoke, and reflectively mapped into a Python process before the affected host was isolated and remediated.

osascript - LOOBins

Detect Credential Access with Elastic Security | Elastic Security Labs

Elastic Endpoint Security added kernel-driver-derived file and registry telemetry to detect access to sensitive credential stores, including browser data, Windows SAM and LSA secrets, cached domain credentials, credential files, and Windows Credential Manager. Its behavior protections can block high-confidence credential-theft activity associated with tools and malware such as Mimikatz, LaZagne, AgentTesla, FormBook, and Poulight Stealer; KQL and EQL hunting can also identify processes opening multiple sensitive stores or SMB access following a network logon. Attackers commonly extract saved browser usernames, passwords, cookies, and session tokens from stores such as Chrome’s Login Data and Firefox’s key3.db, key4.db, and logins.json. They also dump Windows LSA secrets and cached domain credentials using utilities including Mimikatz, reg save, Impacket secretsdump.py, CrackMapExec, and gsecdump. Cached Windows credentials are generally stored as DCC2/MS-Cache v2 hashes and require offline cracking rather than pass-the-hash, while Linux Active Directory integrations may retain cached credentials in SSSD or Quest database files.

Brazil malspam pushes Astaroth (Guildma) malware - SANS ISC

Researchers reported that the Guildma banking trojan, also tracked as Astaroth, continued targeting users in Brazil through large phishing campaigns delivering ZIP archives with malicious .LNK files disguised as invoices, payment proofs, tax notices, and COVID-19-themed messages. The malware focused heavily on stealing banking credentials—particularly from Brazilian institutions such as Banco do Brasil—while also harvesting browser, email, e-commerce, and streaming credentials, capturing screenshots and keystrokes, and enabling remote-control functions. Telemetry cited one major wave reaching up to 50,000 first-stage samples per day, underscoring the scale of the operation in Latin America. Analysis showed a fast-evolving, multi-stage infection chain built for stealth and resilience. Guildma/Astaroth abused multiple Windows LOLBins including bitsadmin.exe, regsvr32, wmic, rundll32, certutil, explorer.exe, and Internet Explorer's ExtExport.exe, while newer variants also used the legacy finger.exe client over TCP/79 to fetch commands and a signed Microsoft Silverlight binary, coregen.exe, for Signed Binary Proxy Execution. The malware employed anti-debugging, anti-VM, and locale checks to restrict execution largely to Portuguese-language and Brazil-based systems, stored or loaded modules through obfuscated JScript and alternate data streams, and retrieved encrypted command-and-control infrastructure from YouTube channel descriptions with fallback servers to maintain access if primary infrastructure was disrupted.

Guildma is now using Finger and Signed Binary Proxy Execution to evade defenses

Threat Spotlight: Astaroth - Maze of obfuscation and evasion reveals dark stealer

Command and Scripting Interpreter: AppleScript, Sub-technique T1059.002 - Enterprise | MITRE ATT&CK®