FRIENDLYFERRET is a macOS persistence module within the FERRET malware family. It disguises itself as a system component, including names such as com.apple.secd, while the related FROSTYFERRET_UI module can masquerade as a common application such as ChromeUpdate. The broader family is primarily delivered through spearphishing in which attackers pose as recruiters or prospective employers and direct targets to malicious links or attachments. FERRET operations also use legitimate-looking applications, heavy code obfuscation, and ClickFix-style instructions that persuade users to execute malicious Terminal commands. Other family components provide credential theft, backdoor access, file exfiltration, keylogging, and deployment of AnyDesk.