macOS Infostealer Activity Detection

Daniel Jeremiah@daniyyell

•updated Feb 13, 2026•0•70

This rule set detects network communication associated with macOS infostealers, including C2 infrastructure, SHub stealer heartbeat and exfiltration, and ClickFix staging and landing pages. It identifies specific hostnames and URI paths used by these malicious campaigns.