XLoader malware steals logins from macOS and Windows systems

guest · Jul 21, 2021

XLoader malware steals logins from macOS and Windows systems
July 21, 2021
https://www.bleepingcomputer.com/ne...steals-logins-from-macos-and-windows-systems/

A highly popular malware for stealing information from Windows systems has been modified into a new strain called XLoader, which can also target macOS systems.

XLoader is currently being offered on an underground forum as a botnet loader service that can “recover” passwords from web browsers and some email clients (Chrome, Firefox, Opera, Edge, IE, Outlook,Thunderbird, Foxmail).
Derived from the Formbook info-stealer for Windows, XLoader emerged last February and has grown in popularity, advertised as a cross-platform (Windows and macOS) botnet with no dependencies.
Click to expand...

As mentioned in the advertisement, the makers of XLoader also provide a Java binder for free, which allows customers to create a standalone JAR file with the Mach-O and EXE binaries used by macOS and Windows.

Tracking XLoader 6-month activity up to June 1st, malware researchers at Check Point saw requests from 69 countries, indicating a significant spread across the globe, with more than half of the victims being in the United States.
Click to expand...

Yaniv Balmas, Head of Cyber Research at Check Point Software, says that XLoader is “is far more mature and sophisticated than its predecessors [i.e. Formbook].”

macOS’s growing popularity exposed it to unwanted attention from cybercriminals, who are now seeing the OS as an attractive target.

“While there might be a gap between Windows and MacOS malware, the gap is slowly closing over time. The truth is that MacOS malware is becoming bigger and more dangerous” - Yaniv Balmas
Click to expand...

Check Point Research: Top prevalent malware with a thousand campaigns migrates to macOS

Formbook is currently one of the most prevalent malware. It has been active for more than 5 years already. Check Point reported in December 2020 that Formbook affected 4% of organizations worldwide and made it to the top 3 list of the most prevalent malware.

According to AnyRun Malware Trends Tracker, Formbook occupies the 4th place in a list of the most prevalent malware families in 2020.
Click to expand...

A short time later, Formbook was reborn as XLoader, and the malware is now available for sale in the underground forum by a different avatar. XLoader opened up several new opportunities, with the ability to operate in the macOS being one of the most exciting. XLoader’s story is on-going, and judging by the popularity of the malware, shows no signs of ending any time soon.

Let’s take a look at how it all began.
Click to expand...

Log in or Sign up

XLoader malware steals logins from macOS and Windows systems

guest Guest

Log in or Sign up

XLoader malware steals logins from macOS and Windows systems

guest Guest

Useful Searches