Meta Muse on macOS: Hidden Setting Mic-Prompt Interception — Detection, Lockdown, and Remediation Guide

---
title: macOS Preference Tampering Targeting Meta Muse
description: Detects command-line preference utilities modifying or deleting Meta Muse related preference domains, consistent with local hidden-setting tampering.
references:
  - https://thehackernews.com/2026/09/one-hidden-meta-muse-setting-could-let.html
  - https://attack.mitre.org/techniques/T1112/
author: Security Arsenal
date: 2026/09/22
tags:
  - attack.defense_evasion
  - attack.t1112
logsource:
  category: process_creation
  product: macos
detection:
  selection_tool:
    Image|endswith:
      - '/defaults'
      - '/plutil'
      - '/PlistBuddy'
      - '/sqlite3'
  selection_muse:
    CommandLine|contains:
      - 'Muse'
      - 'Meta Muse'
      - 'com.meta'
      - 'facebook'
  selection_action:
    CommandLine|contains:
      - ' write '
      - ' delete '
      - ' import '
      - ' convert '
  condition: selection_tool and selection_muse and selection_action
falsepositives:
  - User or MDM intentionally changing Muse preferences
  - Meta first-run or update workflows
level: high
---
title: macOS Scripting Runtime Modifying AI Assistant Preferences
description: Detects shells or scripting runtimes executing preference changes against Muse or Meta assistant configuration paths, a common malware and red-team pattern.
references:
  - https://thehackernews.com/2026/09/one-hidden-meta-muse-setting-could-let.html
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/09/22
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: macos
detection:
  selection_parent:
    ParentImage|endswith:
      - '/bash'
      - '/zsh'
      - '/sh'
      - '/python'
      - '/python3'
      - '/osascript'
      - '/ruby'
      - '/perl'
      - '/node'
  selection_target:
    CommandLine|contains:
      - 'Library/Preferences'
      - 'Library/Containers'
      - 'Library/Group Containers'
      - 'com.apple.TCC'
      - 'Muse'
      - 'com.meta'
  condition: selection_parent and selection_target
falsepositives:
  - Legitimate local administration scripts
  - Developer debugging of sandboxed apps
level: medium
---
title: Meta Muse Network Egress to Non-Meta Destination
description: Detects Muse or likely helper processes connecting to destinations outside an approved Meta assistant egress set. Tune DestinationHostname or RemoteIP allowlists before broad deployment.
references:
  - https://thehackernews.com/2026/09/one-hidden-meta-muse-setting-could-let.html
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/09/22
tags:
  - attack.command_and_control
  - attack.exfiltration
  - attack.t1071
logsource:
  category: network_connection
  product: macos
detection:
  selection_process:
    Image|contains:
      - 'Muse'
      - 'Meta'
  filter_meta:
    DestinationHostname|contains:
      - 'meta.com'
      - 'facebook.com'
      - 'fbcdn.net'
      - 'whatsapp.net'
      - 'cdninstagram.com'
  condition: selection_process and not filter_meta
falsepositives:
  - Content delivery networks and analytics endpoints not covered by the allowlist
  - Corporate proxy or inspection services presenting different destination metadata
level: medium

// Hunt local preference or TCC tampering around Meta Muse on macOS endpoints onboarded to Microsoft Defender for Endpoint
let Lookback = 14d;
let ApprovedMetaEgress = dynamic(['meta.com','facebook.com','fbcdn.net','whatsapp.net','cdninstagram.com','oculus.com']);
DeviceProcessEvents
| where TimeGenerated >= ago(Lookback)
| where DeviceOS contains 'macOS' or ProcessVersionInfoOriginalFileName has_any ('defaults','plutil','PlistBuddy','sqlite3','osascript','zsh','bash','python3')
| where FileName in~ ('defaults','plutil','PlistBuddy','sqlite3','osascript','zsh','bash','sh','python','python3')
| where ProcessCommandLine has_any ('Muse','Meta Muse','com.meta','Library/Preferences','Library/Containers','Library/Group Containers','com.apple.TCC')
| where not (InitiatingProcessFileName has_any ('Muse','Meta') or FileName has_any ('Muse','Meta'))
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256, ReportId
| order by TimeGenerated desc;
// Hunt file artifacts under likely preference and container locations
DeviceFileEvents
| where TimeGenerated >= ago(Lookback)
| where FolderPath has_any ('/Library/Preferences','/Library/Containers','/Library/Group Containers','/Library/Application Support')
| where FolderPath has_any ('Muse','com.meta','Meta')
| where ActionType has_any ('FileCreated','FileModified','FileRenamed','FileDeleted')
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, FolderPath, ActionType, SHA256, ReportId
| order by TimeGenerated desc;
// Hunt assistant egress outside approved Meta destinations; replace allowlist with your normalized egress list
DeviceNetworkEvents
| where TimeGenerated >= ago(Lookback)
| where InitiatingProcessFileName has_any ('Muse','Meta') or FileName has_any ('Muse','Meta')
| where ActionType == 'ConnectionSuccess'
| extend Host = coalesce(RemoteUrl, '')
| where not (Host has_any (ApprovedMetaEgress))
| summarize Connections = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Devices = dcount(DeviceName) by DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort, RemoteUrl
| order by Connections desc;

-- Velociraptor hunt artifact: Meta Muse local tamper and egress triage for macOS
-- Collect processes, likely preference artifacts, launch persistence, and network listeners in one pass.

SELECT * FROM foreach(row={
    SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
    FROM pslist()
    WHERE CommandLine =~ 'Muse|Meta Muse|com.meta|defaults|plutil|PlistBuddy|sqlite3|Library/Preferences|Library/Containers|com.apple.TCC'
       OR Exe =~ 'Muse|Meta|defaults|plutil|PlistBuddy|sqlite3'
}, query={
    SELECT 'process' AS ArtifactType, Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
    FROM scope()
})
UNION ALL
SELECT * FROM foreach(row={
    SELECT FullPath, Mtime, Size
    FROM glob(globs=[
      '/Users/*/Library/Preferences/*Muse*',
      '/Users/*/Library/Preferences/*meta*',
      '/Users/*/Library/Containers/*/Data/Library/Preferences/*Muse*',
      '/Users/*/Library/Group Containers/*/*Muse*',
      '/Users/*/Library/LaunchAgents/*.plist',
      '/Library/LaunchAgents/*.plist',
      '/Library/LaunchDaemons/*.plist'
    ])
    WHERE FullPath =~ 'Muse|meta|com.meta|launch'
}, query={
    SELECT 'file' AS ArtifactType, FullPath, Mtime, Size FROM scope()
})
UNION ALL
SELECT * FROM foreach(row={
    SELECT Pid, Name, LocalAddr, LocalPort, RemoteAddr, RemotePort, Status
    FROM netstat()
    WHERE Name =~ 'Muse|Meta'
       OR RemotePort in [443, 80, 8443]
}, query={
    SELECT 'network' AS ArtifactType, Pid, Name, LocalAddr, LocalPort, RemoteAddr, RemotePort, Status
    FROM scope()
})

#!/usr/bin/env bash
# Meta Muse macOS audit and optional lockdown script. Read-only by default.
# Usage: bash muse_hardening.sh          audit only
#        bash muse_hardening.sh --enforce reset candidate TCC grants for discovered Muse bundle IDs
set -euo pipefail
MODE='audit'
if [ '${1:-}' = '--enforce' ]; then MODE='enforce'; fi
STAMP=$(date -u +%Y%m%dT%H%M%SZ)
OUT=/tmp/muse_audit_${STAMP}.txt
exec > >(tee -a "$OUT") 2>&1

echo '[+] Scope'
sw_vers || true
printf 'host: '; hostname
printf 'user: '; id -un

echo '[+] Installed candidates'
/usr/sbin/pkgutil --pkgs 2>/dev/null | /usr/bin/grep -Ei 'muse|meta|facebook' || true
/usr/bin/mdfind 'kMDItemKind == "Application"' 2>/dev/null | /usr/bin/grep -Ei 'Muse|Meta' || true
/ usr/bin/true 2>/dev/null || true

echo '[+] Candidate bundle identifiers'
CANDIDATES=$(/usr/bin/mdfind 'kMDItemCFBundleIdentifier == "*muse*"c || kMDItemCFBundleIdentifier == "*meta*"c' 2>/dev/null || true)
echo "$CANDIDATES"
BUNDLES=$(/usr/bin/osascript -e 'on run argv' -e 'set out to {}' -e 'repeat with p in argv' -e 'try' -e 'set end of out to id of application file p' -e 'end try' -e 'end repeat' -e 'return out' -e 'end run' $CANDIDATES 2>/dev/null || true)
if [ -z "${BUNDLES:-}" ]; then BUNDLES='com.meta.Muse'; fi
echo "bundle candidates: $BUNDLES"

echo '[+] Preference domains mentioning Muse or Meta'
for u in /Users/*; do
  [ -d "$u/Library/Preferences" ] || continue
  echo "-- $u"
  /usr/bin/defaults domains 2>/dev/null | /usr/bin/tr ',' '\n' | /usr/bin/grep -Ei 'muse|meta|facebook' || true
  /usr/bin/find "$u/Library/Preferences" "$u/Library/Containers" "$u/Library/Group Containers" -maxdepth 4 \( -iname '*muse*' -o -iname '*meta*' \) -print 2>/dev/null || true
done

echo '[+] Persistence locations referencing Muse or Meta'
/usr/bin/grep -RIlEi 'muse|meta|facebook' /Library/LaunchAgents /Library/LaunchDaemons /Users/*/Library/LaunchAgents 2>/dev/null || true

echo '[+] Configuration profiles and PPPC context'
if [ $EUID -eq 0 ]; then
  /usr/bin/profiles -P 2>/dev/null | /usr/bin/grep -Ei 'muse|meta|tcc|privacy|microphone|accessibility|screen' || true
else
  echo 'run as root for profile payload detail'
fi

echo '[+] TCC read-only audit requires Full Disk Access for the terminal and appropriate authorization'
for db in '/Library/Application Support/com.apple.TCC/TCC.db' /Users/*/Library/Application\ Support/com.apple.TCC/TCC.db; do
  [ -f "$db" ] || continue
  echo "-- $db"
  /usr/bin/sqlite3 "file:$db?mode=ro" "select service,client,auth_value,auth_reason,last_modified from access where client like '%Muse%' or client like '%meta%' or client like '%facebook%';" 2>/dev/null || true
done

echo '[+] Recent unified log references, noisy but useful during scoping'
/usr/bin/log show --last 24h --style compact --predicate 'process CONTAINS[c] "Muse" OR eventMessage CONTAINS[c] "Muse" OR eventMessage CONTAINS[c] "com.meta"' 2>/dev/null | /usr/bin/tail -200 || true

if [ "$MODE" = 'enforce' ]; then
  echo '[+] Enforcement: resetting candidate assistant permissions. Confirm bundle IDs before production use.'
  for b in $BUNDLES; do
    for svc in Microphone SpeechRecognition Accessibility ListenEvent ScreenCapture SystemPolicyAllFiles SystemPolicyDocumentsFolder SystemPolicyDesktopFolder SystemPolicyDownloadsFolder AppleEvents; do
      /usr/bin/tccutil reset "$svc" "$b" 2>/dev/null || true
    done
  done
  echo '[+] Reset complete. Reopen Muse only after patching and validating configuration.'
else
  echo '[+] Audit complete. Re-run with --enforce only after validating bundle IDs and user impact.'
fi
echo "[+] Evidence saved to $OUT"