The “Compatibility” Trap: New Mac Malware Tricks Users into Bypassing TCC

Darktrace uncovered a macOS phishing campaign that delivers an AppleScript file disguised as a Word document which displays a fake “Compatibility Wizard” prompt to socially engineer users into granting TCC permissions; the malware establishes persistence via LaunchAgents and deploys a modular Node.js loader that checks in with a C2 (sevrrhst.com) to retrieve and execute additional payloads, potentially enabling clandestine access to camera, screen capture, and other sensitive resources.