macOS tags downloaded files with a quarantine attribute, which triggers the Gatekeeper warning before an untrusted app runs. Attackers strip that tag so their payload launches silently. Huntress now catches this. It's a common step in AMOS, Poseidon, Odyssey, and MacSync infostealer attacks.
We watch the system call itself, not the xattr command, so it doesn't matter whether the attacker uses a shell script or a compiled binary. Requires Agent v0.14.196.
Three detections ship with this release:
- Quarantine removed from a file in a common malware staging folder by a script or shell — the pattern ClickFix and AMOS droppers use.
- Quarantine removed from a file on a mounted disk image — how fake installers get around Gatekeeper.
- A fake installer mounted and a quarantine strip on the same machine within five minutes — a strong sign a payload is about to run.
Each detection shows the file, the attribute removed, and the process that removed it. That makes it easy to tell a build tool stripping its own file from malware, clearing its own flag. Apple's own backup and file-sharing services accounted for about 99% of the noise in testing, so we filter those out.