RustyPages macOS Malware Activity

Emil Stahl@emilstahl

•updated Aug 25, 2025•3•3•55

Detects various techniques, procedures, and indicators associated with the RustyPages macOS malware dropper, including persistence, defense evasion, payload download, and known IOCs. This rule specifically looks for the use of `curl` to download a hidden file, `launchctl` to establish persistence, `chmod` to make the payload executable, `xattr` to clear extended attributes, `pgrep` to discover security tools, shell commands to silence notifications, C2 domain/IP connections, and known malware file hashes.