A pure-bash compromise-assessment scanner that inspects persistence, code signatures, network and privacy grants — and never deletes, quarantines, or changes a thing.
$git clone https://github.com/mobinert/machunt.git
The launch agents, signature anomalies, rogue DNS, injected libraries and privacy grants that real macOS implants rely on. It assumes nothing, verifies the code signature of every persistence target, and tells you exactly what to look at — a [FLAG] means “look at this,” not “this is malware.” You stay in control of every decision.
Every auto-run binary is classified Apple-signed, Developer ID, ad-hoc, unsigned or invalid — plus a notarization check on real vendors.
LaunchAgents/Daemons, login items, cron, at, login hooks, emond and configuration profiles — every place implants live.
Listening ports, established outbound connections, rogue DNS, hosts/proxy tampering, and ARP-spoof / MITM detection.
Which apps hold camera, mic, screen-recording or full-disk access — the number-one signal of stalkerware.
DYLD library injection, legacy environment.plist, and unexpected trusted root CAs that silently decrypt your HTTPS.
Fingerprints persistence and alerts on anything new between runs, then grades your posture 0–100.
Run as your user, or with sudo for deep coverage of system daemons, TCC, sudoers and every port.
For every binary that auto-runs, machunt reads the code signature and tells you what it means.
Shipped by Apple — expected.
A real vendor — confirm it’s one you installed.
Signed, but Apple never malware-scanned it.
Common in malware — investigate.
Every run ends with a score and a letter grade, so you can track a machine over time at a glance. It starts at 100 and deducts per finding by severity.
The same breakdown is written to the --html and --json outputs. A high score is reassuring — not a clean bill of health.
rm, no kill, no quarantine, no config changes — ever. Every finding is yours to review and act on..gitignore keeps scan reports and your baseline uncommitted by default.git clone https://github.com/mobinert/machunt.git && cd machuntchmod +x machunt.sh./machunt.sh --htmlsudo ./machunt.sh --deepReports save to the directory you run from (and a copy on your Desktop). Add --json for a machine-readable summary. Run ./machunt.sh --help for every option.