Weaponizing Apple AI for Offensive Operations

Weaponizing Apple AI for Offensive Operations

Speaker: Lead Red Teamer, CVS Health

Conference: Black Hat USA 2025 — August 6-7, 2025, Mandalay Bay, Las Vegas

YouTube: https://www.youtube.com/watch?v=UooCY59nQSQ

Reading Time: ~6 minutes

Type: Briefing

TL;DR

A lead red teamer at CVS Health demonstrated how Apple's native AI frameworks — CoreML, Vision, and AVFoundation — can be weaponized for C2 operations, payload staging, and evasion. None of the techniques were detected by tested EDR or antivirus engines, exploiting a fundamental blind spot: security tools do not scan .mlmodel files.

Introduction

Modern macOS ships with a suite of native AI and multimedia frameworks that operate silently in the background of legitimate applications. CoreML handles on-device machine learning inference, Vision processes images and text, and AVFoundation handles audio and video. These frameworks are trusted, widely used by Apple and third-party apps alike, and — critically — not monitored by security tooling in any meaningful way.

The speaker's research asks a simple question: if these frameworks are trusted and invisible to defenders, can they serve as a payload delivery channel? The answer, demonstrated live at Black Hat USA 2025, is yes. The talk introduced MLARC, a proof-of-concept C2 framework that communicates entirely through CoreML model files, and showed that established macOS payloads like Apfell (a Mythic C2 agent) can be encrypted, embedded in .mlmodel files, and executed without triggering any current EDR detection.

Apple's AI Stack: The Attack Surface

▶ Watch: Apple AI Stack Overview (02:00)

The Apple AI stack has two primary layers relevant to this research:

CoreML is the legacy, device-side inference engine, shipped with every iPhone and Mac, used by Apple's own apps (Photos, Siri) and countless third-party applications. A CoreML model file — with a .mlmodel extension or its compiled variant .mlmodelc — contains model descriptions, a model type specification, and model parameters (the "weights"). Weights are not human-readable; they require the CoreML framework to parse, and no current AV or EDR engine performs semantic analysis of their contents.

Apple Foundation Model is a newer, closed framework reserved for Apple's own large-scale AI features and is not publicly accessible — making CoreML the relevant attack surface.

On top of CoreML sit the Vision and AVFoundation frameworks. Vision provides native APIs for image processing, OCR, and text recognition. AVFoundation handles audio/video synthesis and playback. Both are used legitimately by applications like Zoom, CapCut, and iMovie — making their API calls appear normal in behavioral logs.

Payload Staging via CoreML Model Files

▶ Watch: Abusing CoreML Layers (06:00)

CoreML model files offer two natural embedding locations for malicious payloads:

1. Model metadata — the descriptive fields in the model spec, which accept arbitrary string data
2. Model weights — the numerical parameters themselves, which can store arbitrary bytes encoded as floating-point values

The speaker demonstrated both embedding paths. For a metadata-based approach, an attacker generates a model file in memory, injects an encrypted payload (for example, hex-encoded shellcode) into the metadata fields, serializes the model to binary, and transmits it over the network. The receiving agent uses CoreML libraries to reconstruct the model, extracts the hex-encoded payload, decodes it, and executes it. For weights-based embedding, arbitrary byte sequences are stored as float32 values in model parameter layers.

The .mlmodelc compiled format offers an additional layer of obfuscation, as it is further removed from plaintext inspection.

Steganographic Channels via Vision and AVFoundation

▶ Watch: Vision Framework Demo (10:03)

Vision-based pixel steganography: The speaker embedded encryption keys inside image files by encoding them into pixel data at low opacity (as low as 1%, invisible to the human eye). A Python script generates a legitimate-looking image with the key stored in pixel values. At runtime, a loader uses Vision's native APIs to read the image, extract raw pixel data, and reconstruct the key — all via calls that look identical to legitimate image processing. The key can be embedded in an application's own logo file and shipped as part of the bundle.

AVFoundation audio channel: Instead of embedding payloads in audio metadata or descriptions, the speaker encodes payload data as amplitude values in a synthesized audio waveform. When played, the file produces a beep. When parsed via AVFoundation's PCM extraction APIs, the raw amplitude sequence decodes to the original payload bytes. The speaker demonstrated transmitting up to 1 MB of payload data in a single audio file that passes visual inspection and audio playback without triggering any scanner.

The speaker noted that while the techniques resemble steganography conceptually, they differ in that the legitimate native APIs — not external parsing libraries — perform the extraction. This means the process looks architecturally identical to how a real multimedia application would operate.

MLARC: A CoreML-Native C2 Framework

▶ Watch: MLARC Demo (12:03)

MLARC (ML Architecture Remote Control) is a lightweight Python-based C2 framework that uses .mlmodel files as its entire communication medium. The architecture:

1. C2 server receives a command from the operator and encodes it into an .mlmodel file — placing the command payload in model metadata — then sends the binary model to the agent
2. Agent (dropper) uses CoreML libraries to receive and decode the model file, extract and execute the payload, then encode the output back into a new model file
3. Agent → server the output model file is transmitted to the C2 server, which again uses CoreML to decode the response and display it

The speaker demonstrated this live: an agent established a session, the operator issued a command, and the response came back as a reconstructed CoreML model — all without JSON or traditional protocol structures. The entire exchange was invisible to tested EDR products.

MLARC was tested against "the latest EDRs and AV engines" and produced zero detections.

Bypassing EDR with Apfell Payloads via Native APIs

▶ Watch: Apfell Bypass Demo (16:03)

For operators who prefer established C2 platforms, the speaker demonstrated using MLARC's techniques to weaponize the Apfell agent (a well-known Mythic payload). Raw Apfell code triggers current EDR detections when run directly. The bypass flow:

1. Generate an XOR encryption key and embed it in an image file using pixel steganography
2. Encrypt the Apfell .js source with that key, storing the ciphertext in a text file
3. Embed the encrypted Apfell code into a .mlmodel file (in model weights) using CoreML libraries
4. Bundle the model file and image file with the application package, with the image posing as an application logo
5. At runtime: use Vision APIs to extract the XOR key from the image pixels, use CoreML APIs to extract the encrypted Apfell code from model weights, decrypt and execute

This combination produced zero detections across all tested security tools. The speaker confirmed this technique has "never been detected during any of our operations."

Detection Blind Spots and Mitigations

▶ Watch: Detection Gaps and Defenses (20:04)

The root cause of the detection gap is that .mlmodel files are treated by AV and EDR engines as static data files with no scanning value. Even if scanned, the binary format requires CoreML to interpret — the payload content is not accessible to pattern-matching scanners.

The speaker's recommended detection strategies:

• Monitor what loads .mlmodel files. If an application loads a CoreML model it has no business loading, that is suspicious. Track which binaries call MLModel APIs.
• Audit API usage patterns. Applications that call Vision framework APIs without a legitimate imaging purpose, or that call AVFoundation PCM extraction APIs unexpectedly, warrant investigation.
• Write custom detection rules. No current EDR vendor has rules for these behaviors. Blue teams must build their own behavioral detections around CoreML, Vision, and AVFoundation API invocations.
• Treat .mlmodel files as executable artifacts rather than static data when bundled with applications that lack a clear ML use case.

Notable Quotes

"As of today, none of the EDRs or AV engines scan for model files, and that's why you can weaponize this."

— Speaker ▶ 22:04

"The audio file looks legit. When you play it, it still plays, so it doesn't look fishy — but you can literally send one megabyte of payload in an audio file."

— Speaker ▶ 12:03

"This MLARC C2 is completely stealthy. It's been tested against the latest EDRs and AV engines. None of them been caught."

— Speaker ▶ 16:03

"Look for suspicious API calls. If an application doesn't need to load image Vision libraries, why is it calling them?"

— Speaker ▶ 20:04

Key Takeaways

• CoreML model files are a blind spot for all tested EDRs and AV engines. Payloads embedded in model weights or metadata are undetectable by current scanning approaches.
• Vision and AVFoundation provide native, trusted extraction channels for steganographically embedded payloads and keys, with API call profiles identical to legitimate applications.
• MLARC demonstrates end-to-end C2 via CoreML — no JSON, no traditional protocol markers, no detections in testing against production security tools.
• Established payloads like Apfell can be made undetectable by embedding them in .mlmodel files with keys stored in pixel data, using only native Apple APIs for execution.
• Detection requires behavioral rules. Static signatures will not catch these techniques. Defenders must monitor CoreML, Vision, and AVFoundation API usage and flag applications invoking them without a legitimate use case.

Slides

No slides PDF was listed for this briefing. All proof-of-concept code was published by the speaker on their blog, linked during the talk.