MacOS Infostealer C2 and Staging Domain Activity

Daniel Jeremiah@daniyyell

•updated Feb 12, 2026•2•0•36

This rule detects network communication with known command and control (C2) domains, ClickFix domains, and staging domains associated with macOS infostealers. It also identifies heartbeat communication patterns to these C2 domains, indicating potential active infections.