XMRig miner quarantine xattr removal and archive cleanup in /tmp (Phexia)

ills3c Intel&Coffee@Ills3C

•updated yesterday•0•0•0

Detects macOS process events indicating the removal of quarantine attributes (xattr) on files related to XMRig or rigupdater, followed closely by the deletion (rm) of the associated tarball archive within a 30-minute window on the same device.