What it is

A macOS installer package (ecc-darwin-arm64.pkg, ~167 MB) presented as an "Endpoint Compliance Check." It bundles legitimate open-source secret-scanning tools and weaponizes them against the host.

What it does

On install, it walks every user's home directory looking for SSH keys, cloud credentials, browser-saved logins, shell history, and tokens, then ships the encrypted findings to an attacker-controlled S3 bucket and self-destructs.

Why it matters

• One successful install yields the keys to a developer's entire cloud / SaaS / source-control footprint.
• The attack lives off legitimate, code-signed binaries (TruffleHog, Gitleaks) — minimal AV signal.
• Self-cleanup makes post-incident triage difficult; victims may not know they were hit.
• Distribution pattern matches the active "fake recruiter / take-home assignment" campaigns targeting engineers.

Presentation

• Filename suggests an Apple Silicon build of a corporate compliance utility.
• Bundle identifier com.endpointcompliancecheck.ecc — plausible-sounding namespace.
• Standard macOS Installer flow — user is prompted for an admin password to install.
• Install path /Library/EndpointComplianceCheck/ecc mimics legitimate enterprise agents.

Likely delivery vector

Pattern matches the "fake interview / take-home assignment" social-engineering campaigns: a "recruiter" or "hiring manager" asks the target to install a tool to complete an exercise.

PackageInfo (excerpt)

<pkg-info
  identifier="com.endpointcompliancecheck.ecc"
  version="1.0.0"
  install-location="/Library/EndpointComplianceCheck/ecc"
  auth="root">
  <payload numberOfFiles="8966"
           installKBytes="471717"/>
  <scripts>
    <postinstall file="./postinstall"
                 timeout="600"/>
  </scripts>
</pkg-info>

Note: auth="root" escalates the postinstall to full system privilege.

From scan_config.yaml

s3_upload:
  enabled: true
  bucket: "axs-ecc"
  prefix: "ecc"
  region: "us-west-1"
  access_key_id: "AKI...X6G"
  secret_access_key: "dLvcr...hmvb"
  tags:
    managed_by: "ecc"

Encryption layer

Findings are encrypted with a bundled RSA public key before upload. Only the holder of the private key (the operator) can read them.

Why this is the smoking gun

• No legitimate enterprise tool ships long-lived IAM access keys in cleartext config.
• The bucket name and key are operator-controlled — uploads land directly in attacker storage.
• RSA wrapping protects the operator from incidental access (e.g., AWS abuse review) while the data is in transit / at rest.

Self-cleanup

# Final lines of the launcher
rm -rf "${ECC_DIR%/*}"
pkgutil --forget "com.endpointcompliancecheck.ecc"
rm -f /tmp/.ecc_launch.sh
rm -f "${LOG}"

No on-disk artifact remains. Forensic recovery is non-trivial.

Filesystem

Install root

/Library/EndpointComplianceCheck/ecc

Launcher

/tmp/.ecc_launch.sh

Runner

/tmp/.ecc_runner.sh

Output dirs

/tmp/.ecc_output_*

Module 1 staging

/tmp/ecc_m1_*

Log

/var/log/ecc-postinstall.log

Package metadata

Bundle ID

com.endpointcompliancecheck.ecc

Version

1.0.0

Filename pattern

ecc-darwin-arm64*.pkg

File count

8,966

Install size

~471 MB

Network & cloud

S3 bucket

axs-ecc

Region

us-west-1

Object prefix

ecc/

Object tag

managed_by=ecc

AWS access key

AKI...X6G

Behavioral signals

• Postinstall script spawning a detached process under /tmp
• Mass reads of ~/.ssh/id_*, ~/.aws/*, browser profile dirs from a non-user process
• Unsigned or third-party-signed binaries named trufflehog or gitleaks executed as root
• Outbound HTTPS to *.s3.us-west-1.amazonaws.com from a process not associated with a known SaaS app

For confirmed-affected hosts

1. Isolate the host from the network immediately.
2. Capture /var/log/ecc-postinstall.log and any /tmp/.ecc_* remnants before they're wiped.
3. Reimage. Do not attempt in-place cleanup — assume any persistence mechanism on disk.
4. Rotate every credential that lived on the box: SSH keys, all cloud IAM, GitHub / GitLab / Bitbucket PATs, npm/PyPI tokens, Slack / Notion / Jira tokens, browser-saved passwords, 1Password / keychain items.
5. Audit access logs for those credentials going back to the suspected install date.
6. For each affected developer's git repos: review commits and CI/CD secrets for tampering.

External actions

• Report the AWS access key + bucket to aws-abuse@amazon.com with the .pkg as evidence; AWS can disable the keys and preserve bucket contents for law enforcement.
• File an IC3 complaint (or local equivalent) if the target was social-engineered.
• Submit the .pkg to VirusTotal and to product-security@apple.com for XProtect / Notarization revocation.
• If delivered via a "recruiter" account, report the account to the hosting platform (LinkedIn, GitHub, job board).

Endpoint policy

• Block install of unsigned / non-Notarized .pkg files via MDM (Gatekeeper policy + spctl).
• Restrict admin rights on developer endpoints; require JIT elevation for installer authorization.
• EDR rule: alert on postinstall scripts that write to /tmp and detach from the installer.
• EDR rule: alert on processes reading multiple sensitive credential paths in rapid succession.

Developer hygiene

• Move long-lived SSH keys to FIDO2 / hardware-backed (Secretive, YubiKey).
• Replace static cloud keys with short-lived SSO sessions (AWS SSO / IAM Identity Center, gcloud auth, az login).
• Push secrets out of dotfiles and into a managed vault (1Password, op CLI, Vault).

Detection coverage

• Add the IOCs from slide 7 to the SIEM watchlist and EDR custom rules.
• Enable CloudTrail data events on developer S3 buckets and AWS GuardDuty for anomalous IAM use.
• Enable GitHub IP allowlisting / device verification for engineering org members.
• Subscribe credential-leak feeds (GitGuardian, Have I Been Pwned, internal canary tokens).

Awareness

• Brief engineering on the active "fake recruiter / take-home" malware pattern.
• Establish a no-questions-asked reporting channel for suspicious recruiter outreach.
• Plant canary tokens in standard developer paths (~/.aws/credentials with monitored keys) to detect future variants.

Immediate (this week)

• Authorize an organization-wide notice describing the lure pattern and how to report.
• Approve emergency credential rotation budget for any confirmed-affected developers (estimated 2-4 hours per person).
• Greenlight EDR rule rollout for the behavioral signatures listed.

Strategic (this quarter)

• Fund the move from static developer credentials to SSO + hardware-key-backed identity.
• Mandate MDM-enforced Gatekeeper policy on all engineering endpoints.
• Stand up a canary-token program for high-value credential paths.