TLDR Tech / InfoSec
TChCh-Changes: A Look at macOS TCC Manipulation in the Wild
A cluster of AppleScript-based macOS malware delivers a run-only .scpt file disguised as a document compatibility wizard, which fetches a second stage that drops a decoy document and compiles a backdoor into an ad hoc-signed app bundle, then renames the userspace TCC directory via Finder AppleEvents to copy out TCC.db, writes permissions for the backdoor directly with sqlite, restores the directory, and kills tccd to force a reload. Written permissions include Documents, Downloads, Desktop, Finder AppleEvents, and notably kTCCServiceSystemPolicyAppData covering Mail and Notes data. The resulting beacon persists via LaunchAgent, harvests filenames and hardware identifiers from key user folders, and polls for follow-on AppleScript over C2 domains cigalsn[.]com and ecoferros[.]com. Targeting overlaps with North Korean actor Sapphire Sleet against cryptocurrency-sector employees, though the report assesses this as a distinct subgroup. The technique fails outright on Tahoe 26.4.1+ and Sequoia 15.7.7+ (Sequoia is bypassable only if Script Editor already holds Full Disk Access), so defenders should patch to current macOS builds, treat unexplained tccd termination as suspicious, and hunt for TCC.db entries lacking a corresponding tcc_modify Endpoint Security event as a sign of synthetic insertion.
Read the full story