MACOS APT OceanLotus XOR Decode

Tim Peck@timpeck

•updated Oct 30, 2025•4•0•82

Detects the XOR decryption function used in macOS variants of OceanLotus (APT32). This rule targets a specific byte sequence identified in the malware's decryption routine.