GhostLoader GhostLoader macOS malware

Daniel Jeremiah@daniyyell

•updated Mar 31, 2026•2•0•107

This rule detects outbound network connections to the domain 'trackpipe.dev', which is associated with the GhostClaw/GhostLoader macOS malware. It specifically looks for UUID-like identifiers in the URL path, indicating per-repository communication patterns used by the malware.