In-the-wild Mac malware kept busy in June—here’s a rundown

guest · Jun 29, 2019

In-the-wild Mac malware kept busy in June—here’s a rundown
Newly disclosed OSX/CrescentCore is 1 of 6 Mac threats to come to light this month
June 29, 2019
https://arstechnica.com/information...-for-in-the-wild-mac-malware-heres-a-rundown/

June was a busy month for Mac malware with the active circulation of at least six threats, several of which were able to bypass security protections Apple has built into modern versions of its macOS.

“The team at Intego has observed OSX/CrescentCore in the wild being distributed via numerous sites,” Intego’s Joshua Long wrote of two separate versions of the malware his company has found. “Mac users should beware that they may encounter it, even via seemingly innocuous sources such as Google search results.”
Security evasions
Long said that the CrescentCore versions he observed were signed with certificates belonging to an Apple-trusted developer.
[...] he reported the certificate abuse to Apple, but as early Friday afternoon, a tool called WhatsYourSign, developed by Mac security expert Patrick Wardle, showed both signing certificates remained valid.

CrescentCore uses other techniques to avoid detection and analysis. After targets click on the fake Flash installer/updater, it first checks to see if it’s about to be installed inside a virtual machine or on a Mac that’s running AV software.
Click to expand...

Friday’s Intego post lists one of at least six macOS threats that have come to light this month. Others include:

OSX/Linker, a Mac malware family that exploits a zero-day vulnerability in Gatekeeper so that it can install unsigned malware.

A cryptocurrency miner dubbed LoudMiner by ESET and Bird Miner by Malwarebytes, the two firms that independently discovered it.

Malware dubbed OSX/Newtab, which tries to inject tabs into the Safari browser.

Backdoors dubbed NetWire and Mokes that were installed in in-the-wild attacks exploiting a pair of potent Firefox zerodays to target people involved with cryptocurrencies.

The recent activity is an indication that more and more malware developers are finding it worth their time to create malicious wares for macOS, a platform they largely shunned a decade ago.
Click to expand...

Intego: OSX/CrescentCore: Mac malware designed to evade antivirus

Patrick Wardle: What's Your Sign?

Verifying a file's cryptographic signature can deduce its origin or trustability. Unfortunately on macs there's no simple way to view a file's signature via the UI.
WhatsYourSign adds a menu item to Finder.app. Simply right-, or control-click on any file to display its cryptographic signing information!

WhatsYourSign is utility with a simple goal: from the UI, make it trivial to view any file's cryptographic signing information. A file or binary's cryptographic signature is important as it can determine its creator (Apple proper, a 3rd-party, etc). Moreover, it can help determine whether a file should be trusted. For example, binaries signed by Apple can (always?) be trusted, while files that are unsigned may be untrusted or even malicious.
Click to expand...

Log in or Sign up

In-the-wild Mac malware kept busy in June—here’s a rundown

guest Guest

Log in or Sign up

In-the-wild Mac malware kept busy in June—here’s a rundown

guest Guest

Useful Searches