Introducing macOS Mirage: Next-Generation Apple Silicon Dynamic Analysis and Sigma Detections

In November 2015, we released our first in-house macOS sandbox, Box of Apples, followed by an update in March 2018 that introduced HTML behavior reports, desktop screenshots, and process trees. Over the past decade, the macOS ecosystem and the threat landscape targeting it have changed dramatically. Apple transitioned its hardware architecture from Intel (x86_64) to Apple Silicon (ARM64), hardened its operating system security model, and deprecated legacy dynamic tracing mechanisms. At the same time, macOS threat actors have shifted toward native ARM64 binaries, multi-stage social engineering installers, credential-harvesting AppleScripts, and evasive infostealers.

Today, we are excited to introduce macOS Mirage, our brand-new, ground-up dynamic analysis sandbox built natively for Apple Silicon and macOS 26. macOS Mirage replaces Box of Apples as part of the VirusTotal Multi-Sandbox project, delivering high-fidelity behavioral telemetry, automated Sigma behavioral detections mapped to MITRE ATT&CK, and—exclusively within our Private Scanning product offering—full Interactive Live Analysis.

Why We Built macOS Mirage: Beyond Box of Apples

Box of Apples was designed for an era of Intel-based Macs and relied on dtrace scripts to monitor system calls. As macOS evolved, two structural shifts required a completely new approach:

1. Native Apple Silicon (ARM64) Execution: Modern macOS applications and malware families are compiled natively for Apple Silicon or distributed as Universal Mach-O binaries. Running modern samples on legacy Intel hardware either fails outright or misses architecture-specific execution paths. macOS Mirage runs natively on bare-metal Apple Silicon hardware with Apple's native virtualization stack and macOS 26, ensuring authentic execution fidelity.
2. Modern Kernel-Backed Behavioral Telemetry: In modern macOS releases, System Integrity Protection (SIP) restricts legacy dtrace hooks, and high syscall volumes could cause event drops. macOS Mirage uses modern, kernel-supported macOS security instrumentation to capture process creation, command-line arguments, file system modifications, persistence installation, and access to sensitive credential stores without losing events.

Capability
Box of Apples (2015 / 2018)
macOS Mirage (2026)

Hardware Architecture
Intel (x86_64)
Native Apple Silicon (ARM64)

Operating System
OS X 10.11 El Capitan / 10.13 High Sierra
Modern macOS (including macOS 26)

Supported Payloads
Intel Mach-O bundles and basic installers
ARM64 & Universal Mach-O, .dmg, .pkg, .app, .sh, .py, PDFs

Behavioral Telemetry
Legacy dtrace syscall tracing
Modern kernel-supported security telemetry & accurate process trees

Behavioral Detections
Basic behavior tags
Sigma behavioral rules, MITRE ATT&CK mapping, and YARA scanning

Dropped File Analysis
Basic file list
Automated extraction and recursive multi-engine scanning of dropped payloads

Network Capabilities
Basic NAT egress
Multi-mode networking (Internet, Simulated INetSim, HTTPS MITM, Tor, VPN) (Private Scanning exclusive)

Interactive Control
Automated execution only
Live Mouse, Keyboard & Clipboard Control (Private Scanning exclusive)

Rich GUI Execution and Persistence Tracking

Many macOS samples package their payloads inside disk images (.dmg) or application bundles (.app) that initialize graphical windows, register background services, or trigger system notifications during execution. macOS Mirage provides full graphics acceleration and desktop monitoring, capturing both visual screenshots and underlying system modifications in real time.

Figure 1: Dynamic detonation of a macOS application in macOS Mirage, capturing both the application GUI and a macOS system notification alerting to a newly registered persistent background Login Item.

Figure 2: Full window management, 3D rendering, and Dock process tracking inside macOS Mirage.

In addition to capturing screenshots to show what a user would see on screen, macOS Mirage automatically monitors security-sensitive locations across the operating system, including:

• Persistence Mechanisms: LaunchAgents, LaunchDaemons, Login Items, and cron jobs.
• Shell & Environment Profiles: Modifications to .zshrc, .bashrc, .zshenv, and /etc/profile.
• Credential & Privacy Stores: Unauthorized access to Keychain databases (login.keychain-db), browser cookie and credential stores, SSH keys, and the Transparency, Consent, and Control (TCC.db) database.
• System & Network Configuration: Changes to /etc/hosts, /etc/resolv.conf, and /private/etc/sudoers.

New Behavioral Detections with Sigma Rules: Catching a macOS Info-Stealer in Action

To help analysts quickly identify malicious behavior without sifting through

Read the original article:

Introducing macOS Mirage: Next-Generation Apple Silicon Dynamic Analysis and Sigma Detections