MacOS: Not Invincible to Info Stealers

Many users believe macOS to be unbreachable, but recent discoveries paint a different picture. Malicious actors are targeting macOS with information-stealing malware (infostealers).

The Threat Landscape

Infostealers can infiltrate your system through deceptive means, like:

• Malicious Ads: Clicking on a harmful ad can unknowingly download malware.
• Pirated Software: Downloading software from untrusted sources is a high-risk practice.

These vulnerabilities mirror common Windows infection vectors.

A Case Study: The Amos/Atomic Stealer

This specific info stealer is a prime example:

• Leverages osascript: Similar to how Windows malware might abuse Powershell or wscript, the Amos/Atomic stealer misuses osascript for malicious purposes.

Here's a breakdown of the stealer's steps (technical details omitted for brevity):

1. Hides its activity: The malware operates in stealth mode by hiding its application window.
2. Gathers system information: It collects details about your macOS version, hardware, and displays.
3. Attempts to steal credentials: It displays a fake "System Preferences" prompt, tricking you into entering your password.
4. Scans for installed applications: It creates a list of all the programs on your device.
5. Grabs specific files: It targets files like browser cookies, notes, and documents of specific formats (text files, Word documents, etc.) under a certain size limit.
6. Compresses and removes evidence: The malware creates an archive of the stolen data and then deletes the temporary folder and archive itself to avoid detection.

New Tactics: Signed Installers

While the Amos/Atomic stealer relied on deceptive methods, newer threats are emerging:

• Signed Installers: Some malware can appear as legitimate, signed installers, making them even more deceptive.

Identifying Mac Malware

Here's how you can be vigilant against these threats:

• Be cautious with online interactions: Avoid clicking on suspicious ads and downloading software from untrusted sources.
• Look for red flags: Be wary of unexpected prompts asking for your password, especially those disguised as system settings.
• Consider security software: Security software with real-time monitoring can help detect suspicious activity.

Conclusion

While macOS offers a robust security foundation, it's not foolproof. Staying informed about evolving threats and practicing safe online habits are crucial for protecting your Mac.

Happy and Secure Hunting!

Why hide it if you know you are evil?

185[.]172[.]128[.]0

inetnum: 185.172.128.0 - 185.172.128.255

org: ORG-TL874-RIPE

netname: EVILEMPIRE-MNT