FYI new MacOS 0 day exploit

[jgstew]

• https://siguza.github.io/IOHIDeous/
• https://twitter.com/s1guza/status/947603265700601856

---

Here is a mac virus deconstruction:

• https://objective-see.com/blog/blog_0x26.html

A possible IOC detection relevance:

exists (it as trimmed string) whose(it contains "82.163.143.135" OR it contains "82.163.142.137") of following texts of firsts "nameserver " of lines containing "nameserver " of files "/etc/resolv.conf"