Microsoft: WizardUpdate Mac malware adds new evasion tactics

guest · Oct 22, 2021

Microsoft: WizardUpdate Mac malware adds new evasion tactics
October 22, 2021
https://www.bleepingcomputer.com/ne...dupdate-mac-malware-adds-new-evasion-tactics/

Microsoft says it found new variants of macOS malware known as WizardUpdate (also tracked as UpdateAgent or Vigram), updated to use new evasion and persistence tactics.

As Microsoft security experts found, the latest variant — spotted earlier this month — is likely being distributed via drive-by downloads and it impersonates legitimate software, just as it was when threat intelligence firm Confiant discovered it camouflaged as Flash installers in January.
Since the first variants were observed in November 2020, when it was only capable of collecting and exfiltrating system info, WizardUpdate was updated multiple times by its developers.
Click to expand...

The trojan will deploy second-stage malware payloads, including a malware variant tracked as Adload, active since late 2017 and known for being able to slip through Apple's YARA signature-based XProtect built-in antivirus to infect Macs.

"UpdateAgent abuses public cloud infrastructure to host additional payloads and attempts to bypass Gatekeeper, which is designed to ensure that only trusted apps run on Mac devices, by removing the downloaded file’s quarantine attribute," Microsoft said.
Click to expand...

Malware on the Mac "worse than iOS"
AdLoad, one of the second-stage payloads delivered by WizardUpdate on compromised Macs, also hijacks search engine results and injects advertisements into web pages for monetary gain using a Man-in-The-Middle (MiTM) web proxy

"Today, we have a level of malware on the Mac that we don't find acceptable and that is much worse than iOS," said Craig Federighi, Apple's head of software, in May 2021 under oath while testifying in the Epic Games vs. Apple trial.
Click to expand...

Rasheed187 · Oct 23, 2021

Yup, Apple said it themselves, even on a Mac people should remain cautious. And in my view, people shouldn't blindly rely on macOS built-in protection. I have got this feeling that Win Defender is way more advanced than XProtect and GateKeeper, not surprising because on Windows the chances of encountering nasty malware is way bigger, but Apple should still up their game.

Log in or Sign up

Microsoft: WizardUpdate Mac malware adds new evasion tactics

guest Guest

Rasheed187 Registered Member

Log in or Sign up

Microsoft: WizardUpdate Mac malware adds new evasion tactics

guest Guest

Rasheed187 Registered Member

Useful Searches