As the world continues to rely more on technology, cyber attacks are becoming more common and sophisticated. One of the latest threats is MacStealer, a new information-stealing malware that specifically targets Apple’s macOS operating system. This malware is designed to extract sensitive information from compromised devices, including login credentials, credit card information, and browser cookies.
In this article, we’ll take an in-depth look at MacStealer, its functionality, and how to mitigate this threat.
MacStealer is a new information-stealing malware for macOS that uses Telegram as its command-and-control (C2) platform to exfiltrate data. It primarily affects devices running macOS versions Catalina and later, running on M1 and M2 CPUs. This makes it a significant threat because these are relatively new versions of macOS that have not been widely adopted yet, making it harder to detect and root out.
Telegram is being used as a command-and-control platform by cybercriminals due to its privacy and security features. Criminals can anonymously and securely use Telegram to perform various activities, making it difficult for authorities to track them down. They can issue commands and receive stolen data from compromised systems using Telegram, which makes detection and tracking nearly impossible.
Targeted macOS versions and CPUs
MacStealer targets newer macOS versions like Catalina and later that run on new CPUs like M1 and M2. This is because Apple’s new hardware and software use a different architecture and security protocols to prevent cyber attacks. However, this hasn’t stopped cybercriminals from coming up with new ways to circumvent these roadblocks.
The current state of MacStealer is that while it was first announced on online hacking forums earlier this month, it is still a work in progress. Consequently, the malware’s capabilities may change or expand over time. This makes it even more dangerous, as it can evolve over time, making it even harder to detect and neutralize.
MacStealer has a wide range of capabilities, such as stealing documents, cookies from the victim’s browser, and login information. In particular, it can extract iCloud Keychain data, passwords, and credit card information from popular browsers like Google Chrome, Mozilla Firefox, and Brave. It’s important to note that this malware is specifically designed to go after sensitive information, making it a severe threat to individuals and organizations alike.
Support for harvesting various files
In addition to its information theft capabilities, MacStealer also has the ability to harvest Microsoft Office files, images, archives, and Python scripts, making it a versatile malware that can gather a variety of data types.
Delivery method of MacStealer
The exact method used to deliver MacStealer is not known, but it is propagated as a DMG file (weed.dmg). When executed, it opens a fake password prompt to harvest passwords. Typical channels for spreading stealer malware include email attachments, bogus software downloads, and other social engineering techniques.
Mitigating such threats: Recommendations for users
To mitigate threats like MacStealer, it is crucial to keep your operating system and security software up-to-date. Apple regularly releases security updates and patches for macOS, so ensure that you install these updates as soon as they become available. It’s also important to avoid downloading files or clicking links from unknown sources. Always check the validity of the source and scan the file for malware before downloading it.
MacStealer is a new information-stealing malware that poses a severe threat to macOS devices running on new CPUs. The malware is highly sophisticated and has the ability to exfiltrate sensitive information from compromised systems. As a user, it’s essential to be vigilant and proactive in securing your system to mitigate the risk of malware and cyberattacks. Regularly updating your operating system and security software and avoiding unknown sources of files and links can go a long way in keeping you safe.
