ClickLock quarantine attribute removal via xattr on iCloudsync payload

Kaung Khant Ko@kaungkhantko

•updated Aug 25, 2026•2•0•5

This rule detects the use of the macOS 'xattr' command to remove the 'com.apple.quarantine' extended attribute from files located within '/Library/Application Support/iCloudsync/'. This action is typically performed to bypass macOS Gatekeeper security checks, allowing untrusted binaries or payloads to execute without user confirmation or security prompts.