Suspicious Gatekeeper Quarantine Removal Via Xattr

Tim Peck@timpeck

•updated Apr 10, 2026•4•0•343

Detects attempts to manually remove the Apple quarantine extended attribute using the xattr utility. This technique is often used by malware, such as the notnullOSX stealer, to bypass macOS Gatekeeper protections on downloaded payloads.