UNC5142 Macos Quarantine Bypass With Xattr

Tim Peck@timpeck

•updated Oct 17, 2025•6•0•68

Detects the execution of the 'xattr -c' command on a macOS endpoint. This command is used to clear all extended attributes from a file, including the 'com.apple.quarantine' attribute set by Gatekeeper on downloaded files. UNC5142 uses this technique to bypass macOS security prompts before executing downloaded malware like the ATOMIC infostealer.