Case 0002: A macOS Odyssey: From Credential Prompting to Data Exfiltration | Threat Hunting Labs

Investigate a macOS intrusion where a user-triggered prompt leads to staged data collection, outbound archive upload, and startup persistence enabling repeated remote tasking.