Threat name: OSX.MacStealer

[Eldin]

Hello and good day, team.

I need some support to set up an app for the allowlist exclusion. I've added the executable to the list of excused items; however, I am getting restricted every time to launch the tool.

• Location: /opt/homebrew/Cellar/direnv/2.32.2/bin/direnv

[Eldin]

[treed]

This was fixed yesterday afternoon. You should have seen that stop by now.

[Eldin]

Do you know what was the root cause of such behavior?

[Eldin]

I created a separate group and policy on my end excluding Malware scans, thus the reason I was able to prevent this from happening.

[treed]

It was a rule pushed out to prevent new variants of the MacStealer malware from running, based on its code signature. One note: if you're running things that share the same characteristics as MacStealer, they may not be properly signed, as what we were seeing with MacStealer was not something we anticipated seeing in any real apps in a production environment.

[Eldin]

Thank you for the explanation on this. Is it safe to say I can turn on Malware scanning for the group now?

[treed]

You should be able to, yes. By now, all your endpoints should have gotten the update.