AnalysisPublished 12 Jun 2026

Tracing Digital Intent: New MacOS Tahoe 26 Artifact Discovered

Source Palo Alto Unit 42

macos

Description

Unit 42 has discovered a new macOS Tahoe 26 forensic artifact that tracks user menu selections across the operating system. Learn more here. The post Tracing Digital Intent: New MacOS Tahoe 26 Artifact Discovered appeared first on Unit 42 .

Impact

This artifact does not represent a security vulnerability or threat but rather a new forensic data source. It enhances the ability of investigators to understand user actions and intent on macOS Tahoe 26 systems by providing detailed logs of menu selections. There is no indication of exploitation or risk to system security. The impact is primarily positive for digital forensics and incident response.

Defensive guidance

No remediation or patch is required as this is not a vulnerability but a forensic artifact. Organizations and forensic examiners should consider incorporating the App.MenuItem artifact into their analysis workflows when investigating macOS Tahoe 26 systems. Specialized tools like ccl-segb can be used to parse the data. No security actions are necessary.

Summary

Unit 42 identified a new macOS Tahoe 26 forensic artifact called App.MenuItem within the Apple Biome system. This artifact logs detailed user menu selections system-wide, capturing the exact text of menu items chosen and their timestamps. Stored at ~/Library/Biome/streams/restricted/App.MenuItem/local in SEGB-encapsulated protobuf format, it requires specific parsing tools such as ccl-segb. The artifact enables reconstruction of user workflows and intent by providing a narrative of interactions, such as compressing files or emptying the trash. It enhances forensic investigations by adding human context to technical logs. No exploitation or vulnerability is described; rather, this is a new data source for forensic analysis.

References

unit42.paloaltonetworks.com/new-macos-artifact-discovered/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 12 Jun 2026, 22:23 UTC

References

Community reviews

Related threats