All Detections

Chillyhell Shell Profile Injection

avatar
Tim Peck@timpeck
updated Sep 10, 2025043

Detects modification of common macOS shell configuration files, a technique used by the ChillyHell backdoor for persistence.

YARA-L