New ANY.RUN macOS Sandbox Helps SOC Teams Analyze Apple Threats Faster

ANY.RUN has expanded its interactive sandbox platform to include macOS virtual machines, now available in beta for Enterprise Suite users, enabling security teams to investigate Apple-targeted threats within the same unified environment used for Windows, Linux, and Android analysis.

Modern enterprises no longer operate on a single OS, and security operations centers are expected to investigate threats across every platform under daily pressure.

Engineering, product, and leadership teams are particularly heavy macOS users, making them high-value targets. These employees frequently have access to critical internal systems, code repositories, and sensitive business data.

Despite growing macOS adoption in corporate environments, most SOC investigation workflows have not kept pace. Teams are often forced to rely on separate tools and environments when a macOS-specific sample surfaces, creating fragmentation that slows the entire response cycle.

The downstream effect is measurable: slower alert triage, longer investigation timelines, growing alert backlogs, elevated Mean Time to Respond (MTTR), and increased analyst burnout.

ANY.RUN’s macOS Sandbox Expansion

To close this gap, ANY.RUN now extends its cross-platform sandbox coverage to macOS, giving Enterprise Suite teams the ability to analyze suspicious files and URLs across four major operating systems in a single workflow.

Rather than switching between disjointed tools, analysts can observe full macOS execution behavior, including process activity, file system changes, network connections, and API calls, within the same interface they already use for other OS investigations.

A critical differentiator is the platform’s interactive analysis capability. Some macOS threats are engineered to stay dormant until a user takes a specific action, such as entering a password or approving a system dialog. Traditional automated sandboxes frequently fail to trigger these conditional behaviors, leaving malicious activity hidden during analysis.

Expand your SOC’s cross-platform threat visibility Reduce breach risk with analysis across 4 major OS. Request for Your Team

ANY.RUN’s interactive environment allows analysts to replicate real user actions during sandbox execution, surfacing credential harvesting dialogs, staged execution chains, and social engineering lures that passive analysis would miss.

View full sandbox analysis 

The practical value of macOS sandbox analysis is illustrated by the Miolab Stealer, a macOS-targeting infostealer with a lightweight ~100 KB C-based payload that supports both Intel x86-64 and Apple Silicon ARM64 architectures. Analyzed inside the ANY.RUN sandbox, the malware’s full attack chain becomes immediately visible.

On execution, Miolab presents a fake macOS authentication dialog and validates the entered password using the dscl -authonly command; the malware will not proceed without a successful credential capture.

Once authenticated, it uses system_profiler to collect hardware and system information, then launches an AppleScript routine osascript that scans Desktop, Documents, and Downloads directories for files with extensions such as PDF, TXT, and RTF. Collected files are renamed sequentially and capped at approximately 10 MB total.

The harvested data is compressed into a ZIP archive using the ditto utility and exfiltrated to a command-and-control server via an HTTP POST request executed with curl. A final fake error message is displayed to disguise the operation as a failed system event.

Key behavioral indicators detectable in the sandbox include: osascript-based deceptive dialogs, AppleScript-driven file collection, ditto archive creation, and outbound data uploads via curl.

Integrating macOS into ANY.RUN’s sandbox workflow delivers concrete improvements to SOC performance: faster alert validation within minutes, shorter investigation cycles, broader detection coverage across all four major OS platforms, higher analyst throughput per shift, and reduced alert backlogs during active phishing campaigns or malware outbreaks.

By eliminating the need for separate macOS testing infrastructure, security teams spend less time navigating tooling and more time responding to real threats — an outcome that directly reduces business risk in organizations where Apple devices are part of the critical operational fabric.

Investigate threats across 4 major enterprise environments. Reduce triage delays and respond with confidence. Request for your SOC