MacOS Fileless Payload Execution via Piped Commands

Tim Peck@timpeck

•updated Feb 4, 2026•3•1•93

Detects a command line pattern where `curl` is used to download a payload, which is then piped to `base64` for decoding and `gunzip` for decompression. This technique is commonly used by macOS infostealers like DigitStealer and MacSync to execute malware in memory without writing it to disk.