Understanding the Gradle & .zshrc Script Injection Attack

If your Android Studio project's build.gradle.kts file and shell profile (~/.zshrc) keep reverting to an infected state shortly after cleaning them, you are dealing with a persistent background process or malicious IDE plugin. This attack typically hooks into Gradle's preBuild execution task and establishes persistence on macOS through hidden shell commands or system defaults registry values.

Step 1: Identify the Malicious Background Process (PID)

To stop the reinfection cycle, you need to track down the exact Process ID (PID) monitoring your files. Standard process monitors might miss fast-acting file watchers, so use macOS native tracing tools.

Using fsusage to Monitor File Writes

Open a terminal and run fsusage to audit write events on your shell configuration file in real-time:

sudo fsusage -w -f filesys | grep ".zshrc"

When the file is modified again, fsusage will output the process name and PID responsible for writing to the path.

Checking File Locks with lsof

You can also check which active processes hold open handles on your project files:

lsof | grep "build.gradle.kts"

Step 2: Inspect macOS Persistence Mechanisms

The decoded payload in your ~/.zshrc references defaults read huwbjk .... Malicious actors frequently store obfuscated scripts inside hidden macOS user default keys to avoid file-system detection.

  • Check macOS Defaults: Inspect and delete the malicious default key by running defaults delete huwbjk in your terminal.
  • Inspect LaunchAgents: Look for unrecognized .plist files in persistence directories:
    ls -la ~/Library/LaunchAgents
ls -la /Library/LaunchAgents
ls -la /Library/LaunchDaemons
  • Check active background services using launchctl list for suspicious task identifiers.

Step 3: Audit Android Studio Plugins and Gradle Supply-Chain Dependencies

If the infection re-occurs only when Android Studio or Gradle builds run, a rogue IDE plugin or compromised Gradle initialization script is likely the root cause.

  • Disable Unverified Plugins: In Android Studio, navigate to Settings/Preferences > Plugins and disable or uninstall any third-party or unverified extensions.
  • Check Global Gradle Init Scripts: Malicious scripts can sit in your global Gradle folder and run on every build:
    ls -la ~/.gradle/init.d/
    Remove any unexpected .gradle or .gradle.kts files inside this directory.
  • Enable Gradle Dependency Verification: Implement Gradle checksum verification to ensure compromised dependencies from untrusted repositories are blocked.

Step 4: Clean and Sanitize Your Workspace

Once the background process is terminated and persistence hooks are removed, follow these steps to restore your workspace:

  1. Terminate the malicious process using kill -9 <PID>.
  2. Delete generated backup files: rm build.gradle.kts.bak.
  3. Clean ~/.zshrc and revert Git changes: git checkout -- build.gradle.kts.
  4. Restart your system to ensure no remaining file watchers persist in memory.