Fake Browser Update to Atomic macOS Stealer
A freelance designer's personal Mac is lured by a ClearFake 'your browser is out of date' prompt into downloading a fake Safari update. The bundled app is Atomic macOS Stealer: it phishes the login password, raids the keychain and browser stores, and uploads the loot to a single host over the same channel it uses to communicate. Reconstruct the chain from the macOS endpoint telemetry and the web filter.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Establish how the machine was lured
10A freelance designer's personal MacBook started uploading data to an unfamiliar host this morning, minutes after the owner says they installed a browser update. Start at the very beginning: how did a routine browsing session turn into a malware download?
Identify the file that was downloaded
15The fake-update page offered a download. macOS updates never arrive this way. Pin down exactly what landed on disk so you know what the user actually ran.
Name what executed on the endpoint
15Downloading a disk image is harmless until something runs. Use the endpoint process evidence to identify the application that the user launched from the mounted image.
Pin down the credential theft
15This is a stealer, so the goal is secrets. Determine how it got at the stored credentials on a Mac, beyond the password it phished with a fake dialog.
Follow the stolen data out
15The collected secrets did not stay on the machine. Find where the stealer sent them.
Classify the exfiltration
15Wrap up by mapping how the data left the machine to MITRE ATT&CK. The stealer did not stand up a dedicated upload server: it reused its command channel.
6 tasks · 85 points total
Training Tools
Skills You'll Build
Ideal for newcomers to SOC operations. Guided investigation with clear indicators.
Prerequisites
- No prior experience required
- Familiarity with XDR concepts
- Familiarity with SIEM concepts
Ready to investigate?
More Operations
View allThe Template That Read the Disk
The file-transfer portal that Tideglow Logistics' partners upload to spent a morning returning host files it was never meant to publish, and finished it running an administrator session nobody had logged into. The root cause is CVE-2024-4040 in CrushFTP 10.6.0. Walk the access logs and firewall traffic step by step to trace how a client holding no credentials turned a request parameter into a read of the host, and that read into a takeover.
OneNote Attachment to RAT: A Guided First Investigation
A logistics contracts employee at Glacierline Freight opens an attachment that arrived in her inbox and clicks a button inside it. Minutes later her workstation is running something that appears on no software inventory and is talking to a host that no business process uses. Walk the email gateway records, the file artifacts and the endpoint process tree one step at a time, and work out for yourself which message carried the delivery, what landed on disk, and what ran.
Hijacked Discord Invite to ClickFix Loader: Tracing the Lure
A finance analyst at Halcyon Wealth Partners followed a recycled Discord invite that quietly redirected the browser to a fake verification page. They did what the page asked, and inside the hour the workstation was running a remote-access trojan alongside an info-stealer that shipped browser data straight out of the building. Walk the proxy, endpoint and firewall evidence step by step to trace the lure, the loader, the C2 beacon and the data theft.