Fake Browser Update to Atomic macOS Stealer
A freelance designer's personal Mac is lured by a ClearFake 'your browser is out of date' prompt into downloading a fake Safari update. The bundled app is Atomic macOS Stealer: it phishes the login password, raids the keychain and browser stores, and uploads the loot to a single host over the same channel it uses to communicate. Reconstruct the chain from the macOS endpoint telemetry and the web filter.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Establish how the machine was lured
10A freelance designer's personal MacBook started uploading data to an unfamiliar host this morning, minutes after the owner says they installed a browser update. Start at the very beginning: how did a routine browsing session turn into a malware download?
Identify the file that was downloaded
15The fake-update page offered a download. macOS updates never arrive this way. Pin down exactly what landed on disk so you know what the user actually ran.
Name what executed on the endpoint
15Downloading a disk image is harmless until something runs. Use the endpoint process evidence to identify the application that the user launched from the mounted image.
Pin down the credential theft
15This is a stealer, so the goal is secrets. Determine how it got at the stored credentials on a Mac, beyond the password it phished with a fake dialog.
Follow the stolen data out
15The collected secrets did not stay on the machine. Find where the stealer sent them.
Classify the exfiltration
15Wrap up by mapping how the data left the machine to MITRE ATT&CK. The stealer did not stand up a dedicated upload server: it reused its command channel.
6 tasks · 85 points total
Training Tools
Skills You'll Build
Ideal for newcomers to SOC operations. Guided investigation with clear indicators.
Prerequisites
- No prior experience required
- Familiarity with XDR concepts
- Familiarity with SIEM concepts
Ready to investigate?
More Operations
View allRemovable Media: USB Autorun Malware on a Workstation
A USB drive plugged into a Kaldera Systems workstation auto-ran a malicious shortcut that executed a VBScript dropper, planted a persistence Run key, and began beaconing to an external C2 host. Single-host endpoint triage using XDR process-tree and SIEM Sysmon logs.
UNC6384: Captive-Portal PlugX Implant
A diplomat's managed laptop on an untrusted conference network has its captive-portal check hijacked and is steered to a page posing as a security update. The download is a signed Canon utility paired with a malicious DLL: running the trusted binary side-loads the DLL, which runs PlugX in memory, beacons to a single HTTPS host, and sets a Run key. Reconstruct the chain from the proxy, Sysmon, endpoint, and firewall evidence.
Fighting Ursa: Car-for-Sale Lure to HeadLace
A diplomatic attache clicked a link offering a discounted vehicle for sale, and a trusted Windows program started behaving like malware. Follow the chain from a spearphishing link through an abused web-service redirector and a staged archive to a side-loaded HeadLace loader running under a legitimate signed binary.