Stealer self-duplication into ~/Library/Caches for persistence staging

Duo Tech@duotech

•updated Jul 14, 2026•1•0•1

Detects instances where a process creates, renames, or copies a file into the /Library/Caches/ directory where the resulting file's SHA256 hash matches the SHA256 hash of the initiating process. This behavior suggests a binary or script is creating a copy of itself within a writable system cache directory, a common technique for establishing persistence or running code from a less conspicuous location.