MacOS Native Tools Enable Stealthy Enterprise Attacks

Cisco Talos research describes how attackers are repurposing native macOS features — including Remote Application Scripting (RAS), AppleScript, Finder comments stored in Spotlight metadata, and legitimate protocols/tools like SMB, netcat, git, TFTP and SNMP — to execute code, move laterally and evade detection; the report highlights limited visibility for traditional endpoint/network controls and recommends process-lineage analysis, metadata monitoring and stricter MDM and inter-application communication controls.