CoreML Model Files as a Payload Container

▶ Watch (02:06)

CoreML model files ship with every Mac and iPhone as .mlmodel or compiled .mlmodelc bundles. Their contents are non-human-readable without the CoreML framework, so AV engines and Gatekeeper skip them entirely. Apple does not sign or notarize model files, meaning an application can load an unsigned model without triggering any OS-level check.

The model’s internal structure has three layers worth targeting: the description, the weights (where trained data sits), and the metadata. Injecting a payload into weights stores it as float values. A scanner sees floats, nothing else.

Covert Channels in Vision and AV Foundation

▶ Watch (05:56)

Apple’s Vision framework reads pixel data from images using native APIs that AV scanners never inspect. Shanmugam embedded an encryption key in image pixels at 15% opacity. At 1% it is invisible to the human eye. A second Python script pulls the key back at runtime via Vision libraries. The Vision pixel payload demo (10:33) shows the full generate-and-extract cycle.

AV Foundation encodes payloads as audio amplitude: 1.0 for a 1 bit, 0.2 for a 0 bit. The file plays as a beep tone and passes every scanner. The AV Foundation audio payload demo (11:34) sends 1 MB of payload inside a single audio file, undetected.

“audio files still look legit.” — Hariharan Shanmugam

MLR: A CoreML-Native C2 Framework

▶ Watch (12:59)

MLR is a Python C2 that uses CoreML model files as its only transport. When the operator sends a command, MLR hex-encodes it, injects it into a model’s metadata field, serializes the model to binary, and sends that binary over FastAPI. The agent on the victim Mac deserializes it with CoreML libraries, executes the command, and returns output the same way. No JSON, no shellcode over the wire.

The MLR C2 live demo (15:04) runs ls -la through the full cycle. Every EDR and AV engine tested failed to flag it.

“None of them been caught.” — Hariharan Shanmugam

Staging Mythic Payloads via ML Models and Detection Gaps

▶ Watch (16:40)

Apfell, the standard Mythic payload for Mac, gets caught when run as raw code. The fix: XOR-encrypt the Apfell JavaScript, store the key as pixels in an image, and place the ciphertext in a CoreML model’s weight layer. A loader reads the key via Vision, decrypts via CoreML, and executes in memory. The Mythic Apfell-in-model demo (17:57) produces a live Mythic beacon with no disk artifacts.

Shanmugam calls this

“is like a supply chain attack.” — Hariharan Shanmugam

Hundreds of public model files are loaded by developers without review. No EDR scans .mlmodel files today. Defenders should flag unexpected CoreML and Vision API calls from any process.

Notable Quotes

None of them been caught. Hariharan Shanmugam · ▶ 16:26

audio files still look legit. Hariharan Shanmugam · ▶ 10:13

is like a supply chain attack. Hariharan Shanmugam · ▶ 21:34

Key Takeaways

  • CoreML .mlmodel weights are never scanned by EDRs, making them silent payload containers on every Mac.
  • Apple’s Vision and AV Foundation APIs provide native covert channels that static analysis tools cannot read.
  • Defenders should audit unexpected CoreML, Vision, and AVF API calls rather than relying on file-signature scans.