{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "keep-as-periodic-hunt",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "MacSync Stealer targets highly valuable developer credentials and crypto assets via legitimate AI domains; identifying the initial scripted execution is the only way to stop the theft before session cookies are exfiltrated."
      },
      "name": "MacSync Scripted Execution and Credential Theft",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1566.002",
        "attack.t1204.002",
        "attack.t1059.004",
        "attack.t1027",
        "attack.t1140",
        "attack.t1059.002",
        "attack.t1555.001",
        "attack.t1548.004"
      ],
      "series": {
        "slug": "macsync-stealer-how-a-google-search-for-claude-led-to-a-macos-infostealer",
        "index": 1,
        "title": "MacSync Stealer: How a Google Search for Claude Led to a macOS Infostealer",
        "total": 2
      },
      "related": [
        {
          "hunt": "macsync-persistence-macho-rat",
          "reason": "This hunt focuses on the initial delivery and in-memory theft; long-term persistence via Mach-O RATs and LaunchAgents is a separate stage of the kill chain.",
          "relation": "out-of-scope-alternative"
        }
      ],
      "targets": {
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        }
      },
      "analysis": "A static detection rule for 'curl piped to shell' creates excessive noise in developer environments. This hunt uses a gated flow to first isolate suspicious one-liners and then corroborate them with rare in-memory script logic and exfiltration staging files\u2014a multi-surface pivot that a single process rule cannot perform.",
      "coverage": [
        {
          "stage": "initial-access-clickfix-lure",
          "steps": [
            "curl-to-shell-lead"
          ],
          "status": "covered"
        },
        {
          "stage": "background-zsh-loader",
          "steps": [
            "macsync-script-logic"
          ],
          "status": "covered"
        },
        {
          "stage": "dynamic-applescript-theft",
          "steps": [
            "macsync-script-logic",
            "staging-file-activity"
          ],
          "status": "covered"
        },
        {
          "stage": "persistent-macho-rat",
          "reason": "Belongs to another part of the 'MacSync Stealer: How a Google Search for Claude Led to a macOS Infostealer' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "screen-capture-helper",
          "reason": "Belongs to another part of the 'MacSync Stealer: How a Google Search for Claude Led to a macOS Infostealer' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "wallet-app-trojanization",
          "reason": "Belongs to another part of the 'MacSync Stealer: How a Google Search for Claude Led to a macOS Infostealer' series.",
          "status": "out_of_scope"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "ClickFix Malvertising Lure",
            "slug": "initial-access-clickfix-lure",
            "tactic": "initial-access",
            "techniques": [
              "T1566.002",
              "T1204.002",
              "T1059.004"
            ],
            "observables": [
              "curl -sL [URL] | zsh",
              "claude.ai/share/",
              "Google Ads sponsored search for 'Claude Code'",
              "Display name 'Apple Support'"
            ]
          },
          {
            "name": "Background ZSH Loader",
            "slug": "background-zsh-loader",
            "tactic": "execution",
            "techniques": [
              "T1027",
              "T1140",
              "T1059.004"
            ],
            "observables": [
              "daemon_function",
              "Base64 encoded gzip heredoc",
              "/tmp/osalogging.zip"
            ]
          },
          {
            "name": "Dynamic AppleScript Stealer",
            "slug": "dynamic-applescript-theft",
            "tactic": "credential-access",
            "techniques": [
              "T1059.002",
              "T1555.001",
              "T1548.004"
            ],
            "observables": [
              "osascript in-memory execution",
              "Chromium Safe Storage AES key extraction",
              "TCC prompt for Full Disk Access",
              "User password phishing prompt",
              "Extraction of login keychain secrets"
            ]
          },
          {
            "name": "Mach-O RAT and Persistence",
            "slug": "persistent-macho-rat",
            "tactic": "persistence",
            "techniques": [
              "T1543.001",
              "T1071.001",
              "T1573.002"
            ],
            "observables": [
              "85.206.161.241:8443",
              "WebSocket over TLS",
              "LaunchAgent plist creation in Home folder",
              ".mpwd credential file",
              ".zshrc modification"
            ]
          },
          {
            "name": "Screen Recording Permission Capture",
            "slug": "screen-capture-helper",
            "tactic": "collection",
            "techniques": [
              "T1113",
              "T1548.004"
            ],
            "observables": [
              "Capture agent binary with blank icon",
              "--tcc-only command line flag",
              "-o [path] screenshot output",
              "TCC Screen Recording prompt"
            ]
          },
          {
            "name": "Crypto Wallet Trojanization",
            "slug": "wallet-app-trojanization",
            "tactic": "impact",
            "techniques": [
              "T1539",
              "T1552",
              "T1491"
            ],
            "observables": [
              "Modification of 60+ wallet extensions",
              "Trojanized Ledger Wallet app",
              "Fake recovery phrase phishing HTML",
              "Targeting of 21 desktop wallet apps"
            ]
          }
        ],
        "summary": "A malvertising campaign for 'Claude Code' lures users to a legitimate shared conversation on claude.ai that instructs them to run a curl one-liner. This executes a multi-stage infection chain involving a background zsh loader, a dynamic AppleScript stealer that harvests credentials and keychain data, and a persistent Mach-O RAT. The attack concludes by gaining screen recording permissions and trojanizing crypto wallet applications to phish for recovery phrases."
      },
      "severity": "high",
      "rationale": "Focus on macOS workstations used by developers or researchers who are likely to experiment with AI tools. Use the software inventory to identify targets that have recently installed or searched for AI assistance tools.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An attacker has deployed MacSync Stealer on a macOS host by tricking a user into executing a curl-to-zsh one-liner, which then runs in-memory scripts to harvest credentials and keychains.",
      "parameters": {
        "ai_keywords": {
          "from": {
            "ref": "huntress-macsync",
            "kind": "article",
            "observed": "2026-08-17"
          },
          "type": "list[string]",
          "default": [
            "claude",
            "anthropic",
            "chatgpt",
            "claude code"
          ],
          "description": "Keywords to identify potential target hosts running AI software."
        },
        "scope_hosts": {
          "from": {
            "ref": "analyst-input",
            "kind": "manual",
            "observed": "2026-08-17"
          },
          "type": "list[host]",
          "default": [],
          "description": "Optional list of hosts to narrow the hunt based on the scoping step."
        },
        "lookback_days": {
          "from": {
            "ref": "hunt-standard",
            "kind": "manual",
            "observed": "2026-08-17"
          },
          "type": "number",
          "default": "14",
          "description": "Days of history to examine."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://www.huntress.com/blog/fake-claude-macsync",
          "gates": [
            "dry-run",
            "lint"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://www.huntress.com/blog/fake-claude-macsync",
          "name": "Huntress - MacSync Stealer: How a Google Search for Claude Led to a macOS Infostealer"
        }
      ],
      "blind_spots": [
        {
          "id": "process-history-retention",
          "risk": "If the malvertising event happened more than 14 days ago, the primary lead query will return zero results despite an active infection.",
          "owner": "SOC Infrastructure",
          "stage": "initial-access-clickfix-lure",
          "question": "Whether the initial curl pipe command was executed outside the telemetry retention window.",
          "requires": "hb_process_activity with at least 30 days of command-line history",
          "remediation": "Increase retention for hb_process_activity on macOS endpoints to 30 days."
        },
        {
          "id": "script-logging-disabled",
          "risk": "By default, many macOS systems do not log script block content. Without this, the background logic of the stealer is invisible.",
          "owner": "Mac Platform Team",
          "stage": "background-zsh-loader",
          "question": "Whether the in-memory daemon_function and osascript logic can be observed.",
          "requires": "hb_script_activity with full AppleScript and Shell block logging enabled",
          "remediation": "Deploy MDM profiles to enable comprehensive shell and script block logging."
        }
      ]
    },
    "name": "MacSync Scripted Execution and Credential Theft",
    "description": "This hunt identifies the early stages of a MacSync Stealer infection by looking for the initial scripted delivery and the subsequent in-memory AppleScript execution used for credential theft. It uses a gated approach, first identifying suspicious curl-to-shell patterns before performing a fan-out investigation for in-memory script logic and exfiltration staging files. The hunt focuses on developer environments where AI tools like Claude are common lures."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "series": {
          "slug": "macsync-stealer-how-a-google-search-for-claude-led-to-a-macos-infostealer",
          "index": 1,
          "title": "MacSync Stealer: How a Google Search for Claude Led to a macOS Infostealer",
          "total": 2
        },
        "coverage": [
          {
            "stage": "initial-access-clickfix-lure",
            "steps": [
              "curl-to-shell-lead"
            ],
            "status": "covered"
          },
          {
            "stage": "background-zsh-loader",
            "steps": [
              "macsync-script-logic"
            ],
            "status": "covered"
          },
          {
            "stage": "dynamic-applescript-theft",
            "steps": [
              "macsync-script-logic",
              "staging-file-activity"
            ],
            "status": "covered"
          },
          {
            "stage": "persistent-macho-rat",
            "reason": "Belongs to another part of the 'MacSync Stealer: How a Google Search for Claude Led to a macOS Infostealer' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "screen-capture-helper",
            "reason": "Belongs to another part of the 'MacSync Stealer: How a Google Search for Claude Led to a macOS Infostealer' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "wallet-app-trojanization",
            "reason": "Belongs to another part of the 'MacSync Stealer: How a Google Search for Claude Led to a macOS Infostealer' series.",
            "status": "out_of_scope"
          }
        ],
        "rationale": "An attacker has deployed MacSync Stealer on a macOS host by tricking a user into executing a curl-to-zsh one-liner, which then runs in-memory scripts to harvest credentials and keychains.",
        "blind_spots": [
          {
            "id": "process-history-retention",
            "risk": "If the malvertising event happened more than 14 days ago, the primary lead query will return zero results despite an active infection.",
            "owner": "SOC Infrastructure",
            "stage": "initial-access-clickfix-lure",
            "question": "Whether the initial curl pipe command was executed outside the telemetry retention window.",
            "requires": "hb_process_activity with at least 30 days of command-line history",
            "remediation": "Increase retention for hb_process_activity on macOS endpoints to 30 days."
          },
          {
            "id": "script-logging-disabled",
            "risk": "By default, many macOS systems do not log script block content. Without this, the background logic of the stealer is invisible.",
            "owner": "Mac Platform Team",
            "stage": "background-zsh-loader",
            "question": "Whether the in-memory daemon_function and osascript logic can be observed.",
            "requires": "hb_script_activity with full AppleScript and Shell block logging enabled",
            "remediation": "Deploy MDM profiles to enable comprehensive shell and script block logging."
          }
        ],
        "scoping_notes": "Focus on macOS workstations used by developers or researchers who are likely to experiment with AI tools. Use the software inventory to identify targets that have recently installed or searched for AI assistance tools.",
        "beyond_detection": "A static detection rule for 'curl piped to shell' creates excessive noise in developer environments. This hunt uses a gated flow to first isolate suspicious one-liners and then corroborate them with rare in-memory script logic and exfiltration staging files\u2014a multi-surface pivot that a single process rule cannot perform."
      }
    },
    {
      "id": "scoping-ai-software",
      "type": "query",
      "label": "Identify hosts with AI software",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "endpoint",
        "content": "SELECT device_hostname, package_name, vendor_name FROM hb_software_inventory WHERE (instr(',' || '{{ai_keywords}}' || ',', ',' || LOWER(package_name) || ',') > 0 OR instr(',' || '{{ai_keywords}}' || ',', ',' || LOWER(vendor_name) || ',') > 0)",
        "surface": "hb_software_inventory",
        "description": "Find macOS hosts running AI-related tools that match the malvertising campaign lures.",
        "expected_signal": "A list of hostnames to focus the hunt on. Silence means no known AI software matches were found."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "Identify hosts with AI software",
        "reads": [
          "device_hostname",
          "package_name",
          "vendor_name"
        ],
        "source": "hb_software_inventory",
        "target": "endpoint",
        "content": "SELECT device_hostname, package_name, vendor_name FROM hb_software_inventory WHERE (instr(',' || '{{ai_keywords}}' || ',', ',' || LOWER(package_name) || ',') > 0 OR instr(',' || '{{ai_keywords}}' || ',', ',' || LOWER(vendor_name) || ',') > 0)",
        "silence": "not_evidence_of_absence",
        "expected": "A list of hostnames to focus the hunt on. Silence means no known AI software matches were found.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "curl-to-shell-lead",
      "type": "query",
      "label": "Suspicious curl-to-shell lead",
      "config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "source": "endpoint",
        "content": "SELECT device_hostname, process_name, process_cmd_line, time FROM hb_process_activity WHERE (LOWER(process_cmd_line) LIKE '%curl %' AND (LOWER(process_cmd_line) LIKE '%|%zsh%' OR LOWER(process_cmd_line) LIKE '%|%sh%')) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_process_activity",
        "description": "Identify the primary ClickFix delivery mechanism where curl pipes content directly to a shell interpreter.",
        "expected_signal": "Process events showing one-liner scripted execution. Silence proof that no such command ran within the retention window."
      },
      "parents": [
        {
          "id": "scoping-ai-software"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "label": "Suspicious curl-to-shell lead",
        "reads": [
          "device_hostname",
          "process_name",
          "process_cmd_line",
          "time"
        ],
        "source": "hb_process_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, process_name, process_cmd_line, time FROM hb_process_activity WHERE (LOWER(process_cmd_line) LIKE '%curl %' AND (LOWER(process_cmd_line) LIKE '%|%zsh%' OR LOWER(process_cmd_line) LIKE '%|%sh%')) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Process events showing one-liner scripted execution. Silence proof that no such command ran within the retention window.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "assess-curl-lead",
      "type": "analytic",
      "label": "Assess lead suspicion",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint"
        ],
        "context": [
          "curl-to-shell-lead"
        ],
        "objective": "Judge whether the curl-to-shell commands are consistent with malvertising ClickFix lures, noting any suspicious parent processes or arguments.",
        "description": "Determine if the curl execution looks like the MacSync loader or a legitimate admin task.",
        "max_iterations": 3,
        "expected_signal": "A per-host verdict on whether the command is suspicious enough to proceed.",
        "success_criteria": "A verdict of malicious | suspicious | benign citing specific process command lines."
      },
      "parents": [
        {
          "id": "curl-to-shell-lead"
        }
      ]
    },
    {
      "id": "gate-on-curl",
      "type": "checkpoint",
      "label": "Gate on suspicious execution",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the assess-curl-lead verdict is suspicious or malicious for at least one host",
        "condition": "the assess-curl-lead verdict is suspicious or malicious for at least one host",
        "blind_spot": "process-history-retention",
        "confidence": "high",
        "description": "Open the expensive queries only if a suspicious lead is confirmed.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "assess-curl-lead"
        }
      ]
    },
    {
      "id": "macsync-script-logic",
      "type": "query",
      "label": "MacSync in-memory script logic",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "endpoint",
        "content": "SELECT device_hostname, script_content, time FROM hb_script_activity WHERE (LOWER(script_content) LIKE '%daemon_function%' OR LOWER(script_content) LIKE '%osascript%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY script_content HAVING COUNT(DISTINCT device_hostname) <= 3",
        "surface": "hb_script_activity",
        "description": "Identify the rare background daemon functions and AppleScript keychain theft logic.",
        "expected_signal": "Rare scripts containing MacSync core logic. Silence suggests no scripted theft was captured."
      },
      "parents": [
        {
          "id": "gate-on-curl",
          "branch": "on_supports"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "MacSync in-memory script logic",
        "reads": [
          "device_hostname",
          "script_content",
          "time"
        ],
        "source": "hb_script_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, script_content, time FROM hb_script_activity WHERE (LOWER(script_content) LIKE '%daemon_function%' OR LOWER(script_content) LIKE '%osascript%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY script_content HAVING COUNT(DISTINCT device_hostname) <= 3",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "first_seen"
        },
        "expected": "Rare scripts containing MacSync core logic. Silence suggests no scripted theft was captured.",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "script_content"
          ],
          "rare_below": 3
        },
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "staging-file-activity",
      "type": "query",
      "label": "Exfiltration staging file",
      "config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "source": "endpoint",
        "content": "SELECT device_hostname, file_path, activity_name, time FROM hb_file_activity WHERE LOWER(file_path) = '/tmp/osalogging.zip' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_file_activity",
        "description": "Find the creation of the specific /tmp/osalogging.zip archive used to stage stolen loot.",
        "expected_signal": "Records of the staging zip file being created or modified. Silence means the file was not created or has already been removed."
      },
      "parents": [
        {
          "id": "gate-on-curl",
          "branch": "on_supports"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "label": "Exfiltration staging file",
        "reads": [
          "device_hostname",
          "file_path",
          "activity_name",
          "time"
        ],
        "source": "hb_file_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, file_path, activity_name, time FROM hb_file_activity WHERE LOWER(file_path) = '/tmp/osalogging.zip' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Records of the staging zip file being created or modified. Silence means the file was not created or has already been removed.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "triage-macsync",
      "type": "analytic",
      "label": "Triage infection evidence",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint"
        ],
        "context": [
          "assess-curl-lead",
          "macsync-script-logic",
          "staging-file-activity"
        ],
        "objective": "Analyze the combined results of the curl lead, the rare daemon script logic, and the staging file creation to confirm a successful MacSync infection.",
        "description": "Synthesize the lead and follow-on script/file activity into a final verdict.",
        "max_iterations": 6,
        "expected_signal": "A high-confidence verdict on whether the host is actively infected with MacSync.",
        "success_criteria": "A verdict of malicious | suspicious | benign citing relevant telemetry across all steps."
      },
      "parents": [
        {
          "id": "macsync-script-logic",
          "kind": "merge"
        },
        {
          "id": "staging-file-activity",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "route-infection",
      "type": "checkpoint",
      "label": "Route based on infection status",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the triage-macsync verdict is malicious for at least one host",
        "condition": "the triage-macsync verdict is malicious for at least one host",
        "blind_spot": "script-logging-disabled",
        "confidence": "high",
        "description": "Direct confirmed infections to response and others to documentation.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "triage-macsync"
        }
      ]
    },
    {
      "id": "isolate-and-remediate",
      "type": "action",
      "label": "Isolate and remediate host",
      "config": {
        "target": "endpoint",
        "description": "Halt data exfiltration and remove the malware's active components.",
        "instructions": "Isolate the endpoint from the network. Kill any active zsh processes with daemon_function logic. Remove the staging file at /tmp/osalogging.zip. Prompt the user for an immediate password reset and session revocation.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "route-infection",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "analyst-final-review",
      "type": "task",
      "label": "Analyst final review",
      "config": {
        "assignee": "analyst",
        "description": "Manually verify the findings and confirm remediation success.",
        "instructions": "Review the telemetry for the affected hosts. Confirm if the user actually clicked 'Allow' on the TCC prompts mentioned in the report. Check for any follow-on RAT persistence that may have survived the cleanup."
      },
      "parents": [
        {
          "id": "gate-on-curl",
          "branch": "default"
        },
        {
          "id": "gate-on-curl",
          "branch": "on_unavailable"
        },
        {
          "id": "route-infection",
          "branch": "default"
        },
        {
          "id": "route-infection",
          "branch": "on_unavailable"
        },
        {
          "id": "isolate-and-remediate"
        }
      ]
    },
    {
      "id": "close-out-benign",
      "type": "task",
      "label": "Close out hunt",
      "config": {
        "assignee": "analyst",
        "description": "Finalize the hunt and document the negative result.",
        "instructions": "Log the examined hosts and the time window. Note any visibility gaps in script or process logging for future remediation."
      },
      "parents": [
        {
          "id": "gate-on-curl",
          "branch": "on_refutes"
        },
        {
          "id": "route-infection",
          "branch": "on_refutes"
        },
        {
          "id": "analyst-final-review"
        }
      ]
    }
  ]
}