New CloudMensis malware used to spy on Macs in targeted attacks

guest · Jul 19, 2022

July 19, 2022

Unknown threat actors are using previously undetected malware to backdoor macOS devices and exfiltrate information in a highly targeted series of attacks.

ESET researchers first spotted the new malware in April 2022 and named it CloudMensis because it uses pCloud, Yandex Disk, and Dropbox public cloud storage services for command-and-control (C2) communication.
CloudMensis' capabilities clearly show that its operators' main goal is to collect sensitive info from infected Macs through various means.
Click to expand...

Based on ESET's analysis, the attackers infected the first Mac with CloudMensis on February 4, 2022. Since then, they've only sporadically used the backdoor to target and compromise other Macs, hinting at the campaign's highly targeted nature.
Bypassing privacy protections
After being deployed on a Mac, CloudMensis can also bypass the macOS Transparency Consent and Control (TCC) system, which prompts the user to grant apps permission to take screen captures or monitor keyboard events.
Click to expand...

"At the same time, no undisclosed vulnerabilities (zero-days) were found to be used by this group during our research. Thus, running an up-to-date Mac is recommended to avoid, at least, the mitigation bypasses."
Click to expand...

ESET: I see what you did there: A look at the CloudMensis macOS spyware

Previously unknown macOS malware uses cloud storage as its C&C channel and to exfiltrate documents, keystrokes, and screen captures from compromised Macs
Conclusion
CloudMensis is a threat to Mac users, but its very limited distribution suggests that it is used as part of a targeted operation. From what we have seen, operators of this malware family deploy CloudMensis to specific targets that are of interest to them.
Click to expand...

We still do not know how CloudMensis is initially distributed and who the targets are. The general quality of the code and lack of obfuscation shows the authors may not be very familiar with Mac development and are not so advanced.
Click to expand...

Log in or Sign up

New CloudMensis malware used to spy on Macs in targeted attacks

guest Guest

Log in or Sign up

New CloudMensis malware used to spy on Macs in targeted attacks

guest Guest

Useful Searches