{
  "source": "https://vojtechhron.dev/en/article/cloudflare-malware",
  "title": "Analysis of a Fake Cloudflare Authentication and a macOS Infostealer",
  "exported_at": "2026-08-26T13:34:25.230Z",
  "indicators": [
    {
      "group": "Files and paths",
      "type": "",
      "value": "/tmp/alego.zip"
    },
    {
      "group": "Files and paths",
      "type": "",
      "value": "/tmp/stravy/"
    },
    {
      "group": "Files and paths",
      "type": "",
      "value": "~/.pwd"
    },
    {
      "group": "Files and paths",
      "type": "",
      "value": "~/.username"
    },
    {
      "group": "Network",
      "type": "",
      "value": "uterimoxis.com"
    },
    {
      "group": "Network",
      "type": "",
      "value": "mekoilsuharum.com"
    },
    {
      "group": "Processes / Behavior",
      "type": "",
      "value": "AppleScript dialog titled “macOS Protection Service” requesting the system password"
    }
  ]
}