Meow RAT CIS Geofencing via HIToolbox Plist and Locale Check

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•1

This rule detects attempts to enumerate keyboard input sources or search for Russian keyboard layouts on macOS systems. This activity can be indicative of an adversary performing a 'geofence' check to determine the system's locale or origin, potentially to avoid targeting specific regions.