macOS Stealer - Payload Attribute Stripping (T1222.002)

Ibrahim Saud@tektrix

•updated Jun 22, 2026•0•0•3

Correlates the download of a payload using 'curl' to the /tmp/ directory with an immediate 'chmod +x' command on a file in the /tmp/ directory, making it executable. This sequence of events is indicative of preparing a downloaded script or binary for execution, often seen in the initial stages of infostealer attacks on macOS.