FLATROOF/ROOFDECK macOS backdoors masquerading as system utilities

Ibrahim Saud@tektrix

•updated Sep 21, 2026•0•0•6

Detects process execution attempts where the binary is located in specific, non-standard macOS system library paths often associated with background tasks or masquerading, specifically when the process is invoked with a '--type=renderer' command-line argument. This is a common pattern for malicious code attempting to mimic browser-based or helper processes.