ProRAM macOS ARM64 Mach-O implant disguised as 'updated'

Arnold Chan@slaz

•updated Sep 6, 2026•0•0•0

Detects the ProRAM macOS ARM64 Mach-O implant, identified by specific internal codesign strings, download URLs (cloudfront.net/helper), and local file drop paths ($HOME/updated) consistent with the Funnull threat actor's activity.