Attachment: Fake mobileconfig security update profile

calendar Sep 25, 2026  ·
Share on: linkedin copy

Detects .mobileconfig attachments that present themselves as an Apple 'Security Update' configuration profile but omit the PayloadContent section required for a legitimate profile. These crafted files are used as a lure to trick recipients into installing a bogus update, often paired with payment or account-themed subject lines and disposable or spoofed sender domains.

Sublime rule (View on GitHub)

 1name: "Attachment: Fake mobileconfig security update profile"
 2description: "Detects .mobileconfig attachments that present themselves as an Apple 'Security Update' configuration profile but omit the PayloadContent section required for a legitimate profile. These crafted files are used as a lure to trick recipients into installing a bogus update, often paired with payment or account-themed subject lines and disposable or spoofed sender domains."
 3type: "rule"
 4severity: "high"
 5source: |
 6  type.inbound
 7  and any(attachments,
 8          .file_extension == "mobileconfig"
 9          and strings.icontains(file.parse_text(.).text,
10                                '<key>PayloadDisplayName</key><string>Security Update '
11          )
12          and not strings.icontains(file.parse_text(.).text, 'PayloadContent')
13  )
14    
15attack_types:
16  - "Credential Phishing"
17tactics_and_techniques:
18  - "Impersonation: Brand"
19  - "Social engineering"
20  - "Evasion"
21detection_methods:
22  - "File analysis"
23  - "Content analysis"
24  - "XML analysis"
25id: "39473842-1802-513b-892b-d96756d859a7"
to-top