Decoy app launch via 'open -a' masking background execution

Ankit Mehta@Secvyn

•updated Sep 4, 2026•2•0•2

This rule detects potential malicious activity on macOS where a user or script is prompted to open a legitimate-looking application bundle (decoy) while, in close temporal proximity (within 2 minutes), background processes related to hidden .macos payloads or quarantine flag manipulation via 'xattr' are executed. This is a common pattern for malware to appear legitimate to the user while performing malicious setup or persistence in the background.