A new information-stealing malware has targeted Apple’s macOS operating system to steal sensitive information from compromised devices.
The malware that has been dubbed MacStealer, is the latest example of a threat that uses Telegram as a command-and-control (C2) platform to exfiltrate data. It primarily affects devices running macOS versions Catalina and later running on M1 and M2 CPUs.
According to Uptycs researchers Shilpesh Trivedi and Pratik Jeware , MacStealer can steal documents, cookies from the victim’s browser, and login information.
The malware which was first advertised on online hacking forums at the start of the month, is still a work in progress, with the malware authors planning to add features to capture data from Apple’s Safari browser and the Notes app.
In its current form, MacStealer is designed to extract iCloud Keychain data, passwords and credit card information from browsers like Google Chrome, Mozilla Firefox, and Brave. It also features support for harvesting Microsoft Office files, images, archives, and Python scripts.
The exact method used to deliver the malware is not known, but it is propagated as a DMG file (weed.dmg) which when executed, opens a fake password prompt to harvest the passwords under the guise of seeking access to the System Settings app.
MacStealer is one of several info-stealers that have surfaced just over the past few months and adds to an already large number of similar tools currently in the wild. It is typically spread through different channels, including email attachments, bogus software downloads, and other social engineering techniques.
In order to mitigate such threats, the users are recommended to keep their operating system and security software up to date and avoid downloading files or clicking links from unknown sources.
Comments