MacOS malware persistence 7: PAM module injection. Simple C example

The article you've shared discusses a method of persistence for macOS malware using the TALAppsToRelaunchAtLogin array in the com.apple.loginwindow.plist file. This technique allows malicious applications to persist across user logouts and logins by leveraging a feature intended for restoring recently used applications.

Key Points:

1. Persistence Mechanism:

   • The malware needs to be running in the background when the user logs out.
   • Upon logging back in, macOS restores the application as part of its "reopen last apps" functionality.

2. Implementation Details:

   • A simple C program is used to create a malicious app that runs indefinitely (while(1)).
   • The Info.plist file for the app includes settings like LSBackgroundOnly = true, which prevents the application from appearing in the Dock.
   • An injector script (written in Python) modifies the com.apple.loginwindow.plist file to include the malicious app's path and bundle ID.

3. Technical Steps:

   • The malicious app is moved to a shared directory (/Users/Shared/meow.app).
   • The app is launched manually once to ensure it appears in the session state.

Read the full article at Malware Analysis, News and Indicators - Latest topics

---

Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.