Detection of Unauthorized Access to macOS Web Browser Sensitive Files

Adversaries targeting macOS systems frequently attempt to exfiltrate stored credentials and session tokens to maintain persistence or conduct further unauthorized activities. By accessing files such as cookies.sqlite, logins.json, and various key databases located within browser-specific directories, attackers can bypass multi-factor authentication or directly access protected online services.

This threat brief focuses on detecting unauthorized processes - specifically those that are unsigned, untrusted, or leveraging the osascript utility - that attempt to interact with these sensitive files. Such behavior is a common indicator of modular malware or credential-stealing scripts. Defenders should monitor for these file-access patterns to identify potential information-stealing activity, as these files are rarely accessed by legitimate, non-browser-related background processes.

Attack Chain

1. An attacker gains initial execution on a macOS system via phishing or an exploited application.
2. The attacker identifies the presence of target web browsers (e.g., Chrome, Safari, Brave) by inspecting the file system.
3. The attacker locates sensitive browser storage files, such as Login Data or Cookies.binarycookies, in the user's Library directory.
4. The attacker launches an unsigned binary or a malicious osascript payload to interact with these files.
5. The malicious process opens the sensitive files to read the contents into memory.
6. The exfiltrated data (cookies or passwords) is bundled and encrypted by the attacker's script.
7. The stolen data is exfiltrated to an attacker-controlled command-and-control server.

Impact

Successful access to browser storage files results in the compromise of stored user credentials and active session tokens. This can lead to account takeover, unauthorized access to sensitive corporate or personal SaaS applications, and potential lateral movement within the network. In targeted attacks, this enables persistent access that persists even after browser restarts.

Recommendation

1. Enable file-monitoring telemetry via Elastic Defend or equivalent EDR on all macOS endpoints.
2. Deploy the provided detection rule to identify unsigned or suspicious processes accessing browser-specific files.
3. Investigate any alerts generated by the rule to determine if the process is a legitimate backup tool, security agent, or a malicious credential stealer.
4. If malicious activity is confirmed, isolate the host and initiate a credential rotation for accounts associated with the compromised browser profiles.