
Tearing Apart a Multi-Layer macOS Infostealer Dropper
Full static analysis of a macOS ARM64 infostealer dropper that uses custom encoding, NEON multiply chains, and runtime key derivation to decrypt a 114KB AppleScript payload targeting browser credentials, Keychain, crypto wallets, Apple Notes, and more.