MacSync Infostealer

Bhojraj Joshi@cybrbhojrajjoshi

•updated Apr 22, 2026•4•0•334

This rule detects the execution of a 'curl' command on macOS that attempts to make a POST request to a file named 'salmonela' within the '/tmp/' directory. This pattern is highly suspicious and could indicate an attempt to exfiltrate data, upload malicious content, or interact with a temporary malicious script.