Tag: macos

In April 2022, ESET researchers found a beforehand unknown macOS backdoor that spies on customers of the compromised Mac and solely makes use of public cloud storage companies to speak backwards and forwards with its operators. Following evaluation, we named it CloudMensis. Its capabilities clearly present that the intent of its operators is to assemble info from the victims’ Macs by exfiltrating paperwork, keystrokes, and display captures.

Apple has just lately acknowledged the presence of spy ware focusing on customers of its merchandise and is previewing Lockdown Mode on iOS, iPadOS and macOS, which disables options often exploited to realize code execution and deploy malware. Though not probably the most superior malware, CloudMensis could also be one of many causes some customers would wish to allow this extra protection. Disabling entry factors, on the expense of a much less fluid consumer expertise, seems like an affordable technique to scale back the assault floor.

This blogpost describes the totally different parts of CloudMensis and their inside workings.

CloudMensis overview

CloudMensis is malware for macOS developed in Goal-C. Samples we analyzed are compiled for each Intel and Apple silicon architectures. We nonetheless have no idea how victims are initially compromised by this risk. Nonetheless, we perceive that when code execution and administrative privileges are gained, what follows is a two-stage course of (see Determine 1), the place the primary stage downloads and executes the extra featureful second stage. Curiously, this first-stage malware retrieves its subsequent stage from a cloud storage supplier. It doesn’t use a publicly accessible hyperlink; it consists of an entry token to obtain the MyExecute file from the drive. Within the pattern we analyzed, pCloud was used to retailer and ship the second stage.

Artifacts left in each parts recommend they’re known as execute and Shopper by their authors, the previous being the downloader and the latter the spy agent. These names are discovered each within the objects’ absolute paths and advert hoc signatures.

Determine 2. Partial strings and code signature from the downloader element, execute

Determine 3. Partial strings and code signature from the spy agent element, Shopper

Figures 2 and three additionally present what look like inner names of the parts of this malware: the mission appears to be known as BaD and apparently resides in a subdirectory named LeonWork. Additional, v29 suggests this pattern is model 29, or maybe 2.9. This model quantity can also be discovered within the configuration filename.

The downloader element

The primary-stage malware downloads and installs the second-stage malware as a system-wide daemon. As seen in Determine 4, two recordsdata are written to disk:

1. /Library/WebServer/share/httpd/guide/WindowServer: the second-stage Mach-O executable, obtained from the pCloud drive
2. /Library/LaunchDaemons/.com.apple.WindowServer.plist: a property checklist file to make the malware persist as a system-wide daemon

At this stage, the attackers should have already got administrative privileges as a result of each directories can solely be modified by the foundation consumer.

Determine 4. CloudMensis downloader putting in the second stage

Cleansing up after utilization of a Safari exploit

The primary-stage element consists of an attention-grabbing technique known as removeRegistration that appears to be current to scrub up after a profitable Safari sandbox escape exploit. A primary look at this technique is a bit puzzling contemplating that the issues it does appear unrelated: it deletes a file known as root from the EFI system partition (Determine 5), sends an XPC message to speechsynthesisd (Determine 6), and deletes recordsdata from the Safari cache listing. We initially thought the aim of removeRegistration was to uninstall earlier variations of CloudMensis, however additional analysis confirmed that these recordsdata are used to launch sandbox and privilege escalation exploits from Safari whereas abusing 4 vulnerabilities. These vulnerabilities had been found and well documented by Niklas Baumstark and Samuel Groß in 2017. All 4 had been patched by Apple the identical 12 months, so this distribution method might be not used to put in CloudMensis anymore. This might clarify why this code is not known as. It additionally means that CloudMensis could have been round for a few years.

Determine 5. Decompiled code displaying CloudMensis mounting the EFI partition

Determine 6. Sending an XPC message to speechsynthesisd

The spy agent element

The second stage of CloudMensis is a a lot bigger element, filled with quite a few options to gather info from the compromised Mac. The intention of the attackers right here is clearly to exfiltrate paperwork, screenshots, e mail attachments, and different delicate knowledge.

CloudMensis makes use of cloud storage each for receiving instructions from its operators and for exfiltrating recordsdata. It helps three totally different suppliers: pCloud, Yandex Disk, and Dropbox. The configuration included within the analyzed pattern comprises authentication tokens for pCloud and Yandex Disk.

Configuration

One of many first issues the CloudMensis spy agent does is load its configuration. It is a binary construction that’s 14,972 bytes lengthy. It’s saved on disk at ~/Library/Preferences/com.apple.iTunesInfo29.plist, encrypted utilizing a easy XOR with a generated key (see the Customized encryption part).

If this file doesn’t exist already, the configuration is populated with default values hardcoded within the malware pattern. Moreover, it additionally tries to import values from what appear to be earlier variations of the CloudMensis configuration at:

• ~/Library/Preferences/com.apple.iTunesInfo28.plist
• ~/Library/Preferences/com.apple.iTunesInfo.plist

The configuration comprises the next:

• Which cloud storage suppliers to make use of and authentication tokens
• A randomly generated bot identifier
• Details about the Mac
• Paths to numerous directories utilized by CloudMensis
• File extensions which can be of curiosity to the operators

The default checklist of file extensions discovered within the analyzed pattern, pictured in Determine 7, reveals that operators are curious about paperwork, spreadsheets, audio recordings, footage, and e mail messages from the victims’ Macs. Essentially the most unusual format is probably audio recordings utilizing the Adaptive Multi-Price codec (utilizing the .amr and .3ga extensions), which is particularly designed for speech compression. Different attention-grabbing file extensions on this checklist are .hwp and .hwpx recordsdata, that are paperwork for Hangul Office (now Hancom Workplace), a well-liked phrase processor amongst Korean audio system.

Determine 7. File extensions discovered within the default configuration of CloudMensis

Customized encryption

CloudMensis implements its personal encryption operate that its authors name FlowEncrypt. Determine 8 reveals the disassembled operate. It takes a single byte as a seed and generates the remainder of the important thing by performing a collection of operations on probably the most just lately generated byte.  The enter is XORed with this keystream. In the end the present byte’s worth would be the similar as one among its earlier values, so the keystream will loop. Which means that regardless that the cipher appears advanced, it may be simplified to an XOR with a static key (apart from the primary few bytes of the keystream, earlier than it begins looping).

Determine 8. Disassembled FlowEncrypt technique

Bypassing TCC

Because the launch of macOS Mojave (10.14) in 2018, entry to some delicate inputs, corresponding to display captures, cameras, microphones and keyboard occasions, are protected by a system known as TCC, which stands for Transparency, Consent, and Management. When an software tries to entry sure capabilities, macOS prompts the consumer whether or not the request from the appliance is authentic, who can grant or refuse entry. In the end, TCC guidelines are saved right into a database on the Mac. This database is protected by System Integrity Safety (SIP) to make sure that solely the TCC daemon could make any adjustments.

CloudMensis makes use of two methods to bypass TCC (thus avoiding prompting the consumer), thereby getting access to the display, having the ability to scan detachable storage for paperwork of curiosity, and having the ability to log keyboard occasions. If SIP is disabled, the TCC database (TCC.db) is not protected in opposition to tampering. Thus, on this case CloudMensis add entries to grant itself permissions earlier than utilizing delicate inputs. If SIP is enabled however the Mac is operating any model of macOS Catalina sooner than 10.15.6, CloudMensis will exploit a vulnerability to make the TCC daemon (tccd) load a database CloudMensis can write to. This vulnerability is called CVE-2020–9934 and was reported and described by Matt Shockley in 2020.

The exploit first creates a brand new database beneath ~/Library/Software Assist/com.apple.highlight/Library/Software Assist/com.apple.TCC/ except it was already created, as proven in Determine 9.

Determine 9. Checking it the illegitimate TCC database file already exists

Then, it units the HOME setting variable to ~/Library/Software Assist/com.apple.highlight utilizing launchctl setenv, in order that the TCC daemon masses the alternate database as an alternative of the authentic one. Determine 10 reveals how it’s performed utilizing NSTask.

Determine 10. Mangling the HOME setting variable utilized by launchd with launchctl and restarting tccd

Communication with the C&C server

To speak backwards and forwards with its operators, the CloudMensis configuration comprises authentication tokens to a number of cloud service suppliers. Every entry within the configuration is used for a unique goal. All of them can use any supplier supported by CloudMensis. Within the analyzed pattern, Dropbox, pCloud, and Yandex Disk are supported.

The primary retailer, known as CloudCmd by the malware authors in line with the worldwide variable identify, is used to carry instructions transmitted to bots and their outcomes. One other, which they name CloudData, is used to exfiltrate info from the compromised Mac. A 3rd one, which they name CloudShell, is used for storing shell command output. Nonetheless, this final one makes use of the identical settings as CloudCmd.

Earlier than it tries fetching distant recordsdata, CloudMensis first uploads an RSA-encrypted report in regards to the compromised Mac to /January/ on CloudCmd. This report consists of shared secrets and techniques corresponding to a bot identifier and a password to decrypt to-be-exfiltrated knowledge.

Then, to obtain instructions, CloudMensis fetches recordsdata beneath the next listing within the CloudCmd storage: /Febrary/<bot_id>/Could/. Every file is downloaded, decrypted, and dispatched to the AnalizeCMDFileName technique. Discover how each February and Analyze are spelled incorrectly by the malware authors.

The CloudData storage is used to add bigger recordsdata requested by the operators. Earlier than the add, most recordsdata are added to a password-protected ZIP archive. Generated when CloudMensis is first launched, the password is saved within the configuration, and transferred to the operators within the preliminary report.

Instructions

There are 39 instructions applied within the analyzed CloudMensis pattern. They’re recognized by a quantity between 49 and 93 inclusive, excluding 57, 78, 87, and 90 to 92. Some instructions require further arguments. Instructions permit the operators to carry out actions corresponding to:

• Change values within the CloudMensis configuration: cloud storage suppliers and authentication tokens, file extensions deemed attention-grabbing, polling frequency of cloud storage, and so forth.
• Listing operating processes
• Begin a display seize
• Listing e mail messages and attachments
• Listing recordsdata from detachable storage
• Run shell instructions and add output to cloud storage
• Obtain and execute arbitrary recordsdata

Determine 11 reveals command with identifier 84, which lists all jobs loaded by launchd and uploads the outcomes now or later, relying on the worth of its argument.

Determine 11. Command 84 runs launchctl checklist to get launchd jobs

Determine 12 reveals a extra advanced instance. Command with identifier 60 is used to launch a display seize. If the primary argument is 1, the second argument is a URL to a file that can be downloaded, saved, and executed by startScreenCapture. This exterior executable file can be saved as windowserver within the Library folder of FaceTime’s sandbox container. If the primary argument is zero, it can launch the present file beforehand dropped. We couldn’t discover samples of this display seize agent.

Determine 12. Command 60: Begin a display seize

It’s attention-grabbing to notice that property checklist recordsdata to make launchd begin new processes, corresponding to com.apple.windowServer.plist, are usually not persistent: they’re deleted from disk after they’re loaded by launchd.

Metadata from cloud storage

Metadata from the cloud storages utilized by CloudMensis reveals attention-grabbing particulars in regards to the operation. Determine 13 reveals the tree view of the storage utilized by CloudMensis to ship the preliminary report and to transmit instructions to the bots as of April 22^nd, 2022.

Determine 13. Tree view of the listing itemizing from the CloudCmd storage

This metadata gave partial perception into the operation and helped draw a timeline. First, the pCloud accounts had been created on January 19^th, 2022. The listing itemizing from April 22^nd  reveals that 51 distinctive bot identifiers created subdirectories within the cloud storage to obtain instructions. As a result of these directories are created when the malware is first launched, we will use their creation date to find out the date of the preliminary compromise, as seen in Determine 14.

Determine 14. Subdirectory creation dates beneath /Febrary (sic)

This chart reveals a spike of compromises in early March 2022, with the primary being on February 4^th. The final spike could also be defined by sandboxes operating CloudMensis, as soon as it was uploaded to VirusTotal.

Conclusion

CloudMensis is a risk to Mac customers, however its very restricted distribution means that it’s used as a part of a focused operation. From what now we have seen, operators of this malware household deploy CloudMensis to particular targets which can be of curiosity to them. Utilization of vulnerabilities to work round macOS mitigations reveals that the malware operators are actively making an attempt to maximise the success of their spying operations. On the similar time, no undisclosed vulnerabilities (zero-days) had been discovered for use by this group throughout our analysis. Thus, operating an up-to-date Mac is really useful to keep away from, not less than, the mitigation bypasses.

We nonetheless have no idea how CloudMensis is initially distributed and who the targets are. The final high quality of the code and lack of obfuscation reveals the authors will not be very conversant in Mac growth and are usually not so superior. Nonetheless loads of assets had been put into making CloudMensis a strong spying instrument and a menace to potential targets.

IoCs

Information

Public key

-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsGRYSEVvwmfBFNBjOz+Q
pax5rzWf/LT/yFUQA1zrA1njjyIHrzphgc9tgGHs/7tsWp8e5dLkAYsVGhWAPsjy
1gx0drbdMjlTbBYTyEg5Pgy/5MsENDdnsCRWr23ZaOELvHHVV8CMC8Fu4Wbaz80L
Ghg8isVPEHC8H/yGtjHPYFVe6lwVr/MXoKcpx13S1K8nmDQNAhMpT1aLaG/6Qijh
W4P/RFQq+Fdia3fFehPg5DtYD90rS3sdFKmj9N6MO0/WAVdZzGuEXD53LHz9eZwR
9Y8786nVDrlma5YCKpqUZ5c46wW3gYWi3sY+VS3b2FdAKCJhTfCy82AUGqPSVfLa
mQIDAQAB
-----END PUBLIC KEY-----

Paths used

• /Library/WebServer/share/httpd/guide/WindowServer
• /Library/LaunchDaemons/.com.apple.WindowServer.plist
• ~/Library/Containers/com.apple.FaceTime/Information/Library/windowserver
• ~/Library/Containers/com.apple.Notes/Information/Library/.CFUserTextDecoding
• ~/Library/Containers/com.apple.languageassetd/loginwindow
• ~/Library/Software Assist/com.apple.highlight/Resources_V3/.CrashRep

MITRE ATT&CK methods

This desk was constructed utilizing version 11 of the MITRE ATT&CK framework.

As shared by Safari and WebKit evangelist Jen Simmons, each iOS 16 and macOS 13 now support AVIF images.

AFIV picture codec

For these unfamiliar, AFIV is a contemporary picture codec optimized to ship compact information with out shedding important high quality – in contrast to the JPG format. AVIF additionally helps trendy options like transparency, HDR, broad colour gamut, and animated pictures, so it could possibly even exchange GIFs.

The codec is an open normal and is at the moment supported by Google Chrome and Mozilla Firefox. A number of firms resembling Google, Amazon, Netflix, and Microsoft have been backing the AVIF format, and now it appears that evidently Apple will lastly do the identical with AVIF coming to iOS and macOS.

Now you can obtain and open an AVIF picture on gadgets working the most recent betas of iOS 16, iPadOS 16, and macOS Ventura. With the most recent model of the Safari Technology Preview, which is now obtainable to builders, AVIF pictures additionally work on the net. The codec remains to be not working correctly in Safari 16 beta, however this ought to be mounted quickly.

Extra about Safari 16

Different new options in Safari 16 embody Shared Tab Group, sturdy password enhancing, improved CSS, and Passkeys – a brand new solution to authenticate to web sites with Contact ID with out having to create a conventional password.

Apple has been inviting some Mac customers to check out Safari 16 beta, which additionally has a model prepared for macOS Monterey. Nevertheless, if you happen to haven’t been invited, you’ll be able to nonetheless set up Safari Expertise Preview with no need the macOS Ventura beta.

For these unfamiliar, Safari Expertise Preview is an alternate model of Apple’s internet browser that has experimental options. This manner, builders can put together their web sites and internet apps for the brand new applied sciences earlier than they grow to be obtainable to the general public.

Safari 16 will likely be launched to the general public this fall together with iOS 16 and macOS 13.

Learn additionally:

Check out 9to5Mac on YouTube for more Apple news:

There’s an idea of building from first principles that may create some fairly unimaginable merchandise. For instance, one of many applied sciences I’ve lengthy thought was extra sophisticated than it must be is VPN. VPNs got here additional into the highlight with distant work and staff needing to entry firm sources from wherever they’re. I not too long ago got here throughout a product that works nice on macOS that takes that first-principles method to how VPN connections work, and it’s referred to as Tailscale.

About Apple @ Work: Bradley Chambers managed an enterprise IT community from 2009 to 2021. Via his expertise deploying and managing firewalls, switches, a cell machine administration system, enterprise grade Wi-Fi, 100s of Macs, and 100s of iPads, Bradley will spotlight methods by which Apple IT managers deploy Apple gadgets, construct networks to help them, prepare customers, tales from the trenches of IT administration, and methods Apple might enhance its merchandise for IT departments.

Utilizing Tailscale with macOS

I’ve received a reasonably easy use case with Tailscale for private use. I wish to entry my Umbrel server (discover ways to construct one in my past guide) remotely in addition to my Plex server. Umbrel has a Tailscale app in its App Retailer, so the setup was painless. I can now entry it from anyplace. It’s operating on my Umbrel server and my Plex server, so after I wish to hook up with these servers straight, I simply allow Tailscale on my Mac, and I can hook up with these gadgets.

What drawback does this remedy within the enterprise?

Tailscale is constructed on high of WireGuard. WireGuard is a quick encrypted networking protocol that gives quite a lot of efficiency advantages over typical VPNs. Tailscale provides to WireGuard by including computerized mesh configuration, single sign-on help, 2-multi-factor authentication, NAT traversal, and centralized Entry Management Lists (ACLs).

So let’s say you’ve received staff unfold out across the nation (or world), and also you wish to securely allow them to entry safe firm sources like inside servers over VPN whereas letting public web site visitors run regionally. TailScale works this fashion out of the field. It runs as an overlay community and solely routes site visitors between gadgets operating Tailscale however doesn’t contact site visitors not geared toward a Tailscale machine. With this default setup, you’ll be able to go away Tailscale operating always on macOS or iOS with out sending all of your site visitors by them.

To sum it up, Tailscale is an inexpensive VPN that requires no configuration, installs on any machine in a couple of seconds, handles firewall guidelines for you, and works from anyplace. Whereas my use case is 100% private, you’ll be able to see the advantages it might convey to enterprises in all places. Tailscale is actually a VPN for the remote-work world. It’s a type of uncommon options that “simply works.” Pricing begins at free for one person with as much as 20 gadgets, and paid plans begin at $5/month (paid yearly). So, for those who’re struggling to roll out VPN entry to your total firm in a approach that’s not stretching your staff with troubleshooting, try Tailscale. Its VPN so easy, I’m not certain Apple or Google might have made it any simpler. It really works nice on macOS and iPhone and iPad.

Check out 9to5Mac on YouTube for more Apple news:

With the discharge of macOS 12.3, enterprise customers of merchandise like Dropbox and OneDrive had to pay attention to some challenges associated to the cloud-based recordsdata and the Information Suppliers API. Sadly, with macOS 12.3, Apple deprecated the kernel extension that was getting used for this resolution. Whereas each corporations have plans to resolve the issue, it highlights the necessity to audit your distributors and workflows frequently.

About Apple @ Work: Bradley Chambers managed an enterprise IT community from 2009 to 2021. By way of his expertise deploying and managing firewalls, switches, a cellular gadget administration system, enterprise-grade Wi-Fi, 100s of Macs, and 100s of iPads, Bradley will spotlight methods by which Apple IT managers deploy Apple units, construct networks to assist them, practice customers, tales from the trenches of IT administration, and methods Apple might enhance its merchandise for IT departments.

Dropbox was at all times a hack, but it surely labored properly

I’ve been utilizing Dropbox for therefore lengthy that I bear in mind when their solely iPhone app was an online app. Dropbox was a revolutionary strategy to cloud file storage for private customers when it got here available on the market. It was head and shoulders higher than Apple’s iDisk, and Google Drive wasn’t even a product at the moment – it was easy: a folder that syncs. Dropbox gave 2GB away without spending a dime to each person to transform folks to a premium plan. Dropbox was so standard that Apple made them a nine-digit offer again in 2009. Steve Jobs famously referred to as Dropbox a function and never a product; he was each proper and fully unsuitable. He was proper {that a} folder that syncs was a function, however Dropbox, OneDrive, and Google Drive would turn out to be so entrenched within the enterprise that they grew to become merchandise to construct workflows and options round.

Dropbox pioneered this mannequin, however others adopted – together with Apple with iCloud Drive. So at present, now we have Dropbox, Google, Microsoft, and Field all vying to turn out to be your file syncing resolution. As well as, cloud storage suppliers have changed Shared drives on servers for a lot of organizations. The folder that syncs mannequin grew to become so standard that Apple finally built an API for it, so it might make sure the person expertise was firstclass.

Finder Sync helps apps that synchronize the contents of an area folder with a distant information supply. It improves person expertise by offering fast visible suggestions immediately within the Finder. Badges show the sync state of every merchandise, and contextual menus let customers handle folder contents. Customized toolbar buttons can invoke international actions, akin to opening a monitored folder or forcing a sync operation.

Modifications with macOS 12.3

With macOS 12.3, Dropbox and OneDrive noticed challenges in representing online-only recordsdata (ones which are viewable however don’t take up native house). Each corporations have responded rapidly with updates or alerting, however I got here away from this example pondering vendor choice and what’s native versus what’s within the browser. These merchandise have turn out to be very talked-about within the enterprise, and whereas it’s good to have the recordsdata regionally for fast search, and many others. – I feel it highlights the advantages versus the dangers of what sort of apps you utilize regionally versus what’s within the browser. For organizations that depend on Google Workspace, Google Drive’s Shared Drive has turn out to be a well-liked technique to retailer and share recordsdata. Nevertheless, as corporations get bigger, it’s not possible to indicate all of those recordsdata regionally on the pc.

My essential takeaway from this example is that whereas I firmly consider enterprises’ ought to go all-in on cloud storage, there’s part of me that thinks the simplicity of letting these merchandise stay fully within the cloud as a substitute of attempting to combine it inside macOS Finder is likely to be a extra easy resolution long run. Dropbox and OneDrive have aggressively constructed out their internet UI, whereas Google Drive and Field work finest within the browser.

What do you assume? Do the advantages of Finder integration for file suppliers in your group outweigh the issues as Apple evolves macOS? Go away a remark under!

Check out 9to5Mac on YouTube for more Apple news:

Source link

I’ve written numerous articles concerning the progress of software program as a service purposes. There are clear advantages to SaaS enterprise fashions over one-time-use purchases. Many purposes have morphed into home windows right into a cloud service. One “hack” that many IT directors ought to contemplate to streamline their customers’ expertise is “web site particular” purposes designed to launch a single web site.

About Apple @ Work: Bradley Chambers managed an enterprise IT community from 2009 to 2021. By means of his expertise deploying and managing firewalls, switches, a cell gadget administration system, enterprise grade Wi-Fi, 100s of Macs, and 100s of iPads, Bradley will spotlight methods by which Apple IT managers deploy Apple gadgets, construct networks to help them, practice customers, tales from the trenches of IT administration, and methods Apple might enhance its merchandise for IT departments.

One of many “pitches” I made to senior leaders is the flexibility to make use of any software you wish to entry your e-mail. If you happen to bear in mind, on the time, it wasn’t as straightforward to entry Alternate e-mail on OS X and iPhone OS. As well as, Apple solely supported Alternate 2007 when it will definitely did add help throughout its merchandise.

Despite the fact that I pitched as a result of everybody might use their most popular app for e-mail, I secretly needed customers to make use of Google’s net interface. I had this imaginative and prescient of transferring individuals away from Microsoft Workplace to Google Docs and Spreadsheets, so Gmail was my “Malicious program.” I feared that if customers migrated to a different desktop software for e-mail, they’d be much less possible to make use of Google’s net collaboration suite.

Web site Particular Browser

To fight the “lack” of a desktop app, I used Fluid to construct a Google E-mail, Google Calendar, and Google Docs “app” that I deployed as a part of our OS X picture. Because of this, each consumer had these “apps” on their OS X dock after they launched the pc. Moreover, I firmly consider it helped drive the adoption of Gmail and Google’s different productions.

We now know the historical past of what occurred. SaaS-based net apps dominated the subsequent decade, and Google Workspace turned an equal peer to Microsoft within the office for communication and collaboration.

At the moment, many IT directors will deploy net clips to company-owned IT gadgets to assist streamline entry. I nonetheless assume there’s room for site-specific browser apps on macOS as nicely. If your organization makes use of an answer with no strong desktop app, you’ll be able to assist customers shortly entry it by constructing a site-specific browser app and packaging it up. Apps like Fluid, Unite, and Chromeless can all accomplish this activity. You’ll wish to experiment along with your particular purposes and deployment strategies, however I firmly consider it’s nonetheless a useful use case in macOS immediately. I’d positively use a site-specific browser app over a Catalyst software.

Check out 9to5Mac on YouTube for more Apple news: