How to Phish for Geniuses

This report demonstrates a technique for delivering malware to macOS hosts by creating a macOS installer package that contains a postinstall script (generated from an EmPyre bash stager) which runs on installation (often with root privileges). The author details building the package with pkgbuild --nopayload and a scripts folder, shows screenshots of the installer and C2 callback, and highlights using osascript popups to deceive users; the write-up is a proof-of-concept / offensive technique rather than an observed attack campaign.