If you didn't know macOS has a well hidden directory called "/AppleInternal" that is pretty secretive. It's not possible to ls or rm it and I've never seen it referenced before with anything other than fs_usage, where it was being listed frequently as /AppleInternal or /AppleInternal>>>>>>>>>>>>>> with usually between 5 and 20 >.
Thought it was some reference to something other than a directory but the / before AppleInternal made me wonder and google has an article about how to enable it, which apparently added some hidden features to Xcode.
I booted into recovery and used mkdir (you aren't allowed to do it outside of recovery mode) and there is now a folder with that name but its empty. fs_usage no longer makes any reference to /AppleInternal and ls shows the created date as when I used mkdir. Seems like a questionable use if it could just be done away with once discovered as well as be hidden so well and referenced so frequently prior to adding my own.
Seems like a fairly good place to hide malware really.
I found a single, vague reference to AppleInternal in all of the man pages. It's in ani (Apple Net Install) which says AppleInternal and AppleInternalAssistant are both dmg image types.
So does anyone have any idea how it is able to hide so well or have any additional information on its true purpose?