threat-intel
Tracing Digital Intent: New MacOS Tahoe 26 Artifact Discovered
Medium
Summary
Palo Alto Unit 42 has discovered a new Biome stream, ‘App.MenuItem,’ in macOS Tahoe 26 that logs specific menu selections made by users. This artifact provides a detailed record of user actions, offering valuable context for forensic investigations, particularly regarding data exfiltration or understanding user workflows. The stream’s SEGB-encapsulated protobuf entries require specialized tooling for parsing, but its potential for reconstructing user intent is significant.
Summary written automatically in our own words from the original article, which belongs to its publisher and remains the reference. It may contain errors. Sources & data