🛡️ Read-only · macOS 12–15 · v2.0.0

Hunt where macOS malware actually hides.

A pure-bash compromise-assessment scanner that inspects persistence, code signatures, network and privacy grants — and never deletes, quarantines, or changes a thing.

$git clone https://github.com/mobinert/machunt.git
…or grab the single script from the latest release ↗
v2.0.0 MIT License Pure Bash · no deps 24 hunt modules 100% read-only
Why machunt

Antivirus looks for known files. machunt looks for the techniques.

The launch agents, signature anomalies, rogue DNS, injected libraries and privacy grants that real macOS implants rely on. It assumes nothing, verifies the code signature of every persistence target, and tells you exactly what to look at — a [FLAG] means “look at this,” not “this is malware.” You stay in control of every decision.

Capabilities

Built to catch how Macs really get compromised

🔐

Signature verification

Every auto-run binary is classified Apple-signed, Developer ID, ad-hoc, unsigned or invalid — plus a notarization check on real vendors.

📌

Persistence hunting

LaunchAgents/Daemons, login items, cron, at, login hooks, emond and configuration profiles — every place implants live.

🌐

Network & DNS

Listening ports, established outbound connections, rogue DNS, hosts/proxy tampering, and ARP-spoof / MITM detection.

👁️

Privacy & spyware tells

Which apps hold camera, mic, screen-recording or full-disk access — the number-one signal of stalkerware.

🧬

Injection & MITM

DYLD library injection, legacy environment.plist, and unexpected trusted root CAs that silently decrypt your HTTPS.

📈

Baseline & scoring

Fingerprints persistence and alerts on anything new between runs, then grades your posture 0–100.

Coverage

All 24 hunt modules

Run as your user, or with sudo for deep coverage of system daemons, TCC, sudoers and every port.

The full checklist
01Security posture — SIP, FileVault, Firewall, Gatekeeper
02LaunchAgents / Daemons — signature-verified persistence
03Login items — background tasks & helpers
04Cron · at · hooks · emond — scheduled backdoors
05Configuration profiles — forced proxies / certs
06Kernel & system extensions — non-Apple kexts
07Running processes — unsigned / temp-dir binaries
08Network ports — listening & established
09DNS · hosts · proxy — traffic hijacking
10Browser extensions — Safari & Chromium
11SUID / SGID binaries — priv-esc backdoors
12Recently modified files — persistence dirs
13Shell & environment — reverse-shell rc lines
14Known-malware IOCs — documented bad paths
15Privacy permissions (TCC) — camera / mic / screen
16Quarantine / downloads — where files came from
17Baseline diff — alerts on anything new
18Local accounts & sudo — hidden admins
19SSH trust — planted authorized_keys
20Network neighborhood — gateway / ARP / MITM
21XProtect & update freshness — signatures current?
22DYLD injection — library-hijack persistence
23Trusted root certs — HTTPS interception
24Unified-log triage — recent suspicious spawns --deep
The core idea

The signature model

For every binary that auto-runs, machunt reads the code signature and tells you what it means.

🟢 Apple-signed

Shipped by Apple — expected.

🔵 Developer ID

A real vendor — confirm it’s one you installed.

🟡 Not notarized

Signed, but Apple never malware-scanned it.

🔴 ad-hoc / unsigned

Common in malware — investigate.

At a glance

A 0–100 security-posture score

84
GRADE B

Every run ends with a score and a letter grade, so you can track a machine over time at a glance. It starts at 100 and deducts per finding by severity.

score = 100 − (crit×30 + high×12 + med×4 + low×1)
  • CRIT SIP/Gatekeeper off, hidden admin user, passwordless-sudo, LoginHook, known-bad IOC
  • HIGH Unsigned auto-run binary, DYLD-injecting launch item, unexpected trusted root CA
  • MED Firewall off, un-notarized Developer-ID target, SSH enabled

The same breakdown is written to the --html and --json outputs. A high score is reassuring — not a clean bill of health.

Safety first

It never touches a thing

Read-only by design. No rm, no kill, no quarantine, no config changes — ever. Every finding is yours to review and act on.
No dependencies. Pure bash and tools already on macOS. Nothing is installed on your machine.
Nothing leaves your Mac. No network calls, no telemetry. The report is yours alone.
Your data stays out of git. .gitignore keeps scan reports and your baseline uncommitted by default.
Get started

Up and running in 30 seconds

git clone https://github.com/mobinert/machunt.git && cd machunt
Clone the repo and step in.
chmod +x machunt.sh
Make the scanner executable.
./machunt.sh --html
User-level scan + a designed HTML report you can open in any browser.
sudo ./machunt.sh --deep
Full coverage — system daemons, TCC, all ports, and unified-log triage.

Reports save to the directory you run from (and a copy on your Desktop). Add --json for a machine-readable summary. Run ./machunt.sh --help for every option.