A sophisticated new Mac malware campaign has emerged that exploits users’ trust in free online PDF conversion tools, demonstrating how cybercriminals continue to evolve their tactics to bypass modern security measures.
Cybersecurity firm Mosyle has exclusively disclosed the discovery of JSCoreRunner, a previously unknown Mac malware strain that achieved zero detections on VirusTotal at the time of discovery.
The malware propagates through a malicious website called fileripple[.]com, which masquerades as a legitimate PDF conversion service to trick unsuspecting users into downloading what appears to be a harmless utility.
This discovery comes amid a broader trend of cybercriminals exploiting the popularity of free file conversion services.
The FBI’s Denver field office has already issued warnings about the increased risk of malware and data theft from such websites, highlighting how attackers are capitalizing on users’ everyday need for quick format compatibility solutions.
JSCoreRunner operates through a carefully orchestrated two-stage deployment process designed to evade Apple’s built-in security protections.
The initial stage involves a package called FileRipple.pkg, which creates a convincing facade by displaying a fake webview that shows a legitimate-looking PDF tool preview while malicious activities execute silently in the background.
Although Apple has since revoked the developer certificate for this first stage, making macOS block the package on launch, the real danger lies in the second stage.
The unsigned package Safari14.1.2MojaveAuto.pkg bypasses Gatekeeper’s default protections by avoiding the standard signature validation process, allowing it to install without triggering security warnings.
Browser Hijacking and Data Theft Operations
Once successfully installed on a victim’s system, JSCoreRunner demonstrates its primary objective: comprehensive browser hijacking focused specifically on Google Chrome.
The malware methodically traverses the ~/Library/Application Support/Google/Chrome/ directory to identify both default and additional user profiles.
The attack involves creating a malicious TemplateURL object that redefines critical browser settings including the search URL, new tab URL, and display name.
This manipulation effectively redirects users to fraudulent search engines without their knowledge, opening pathways for keylogging, phishing site redirections, and promotion of malicious search results.
To maintain stealth operations, the malware employs additional techniques to hide its presence, including passing arguments to Chrome that suppress crash logs and disable the “restore last session” notification bubble.
Mosyle’s security research team has provided comprehensive technical indicators for cybersecurity professionals to identify and mitigate this threat.
The malware samples include multiple components with distinct hash signatures, ranging from the initial FileRipple.pkg installer to obfuscated JavaScript payloads.
The command-and-control infrastructure follows standard malware protocols, with the installed payload first confirming successful installation with remote servers before proceeding with its browser manipulation activities.
The malware also demonstrates sophisticated system knowledge by identifying the actual user account and removing quarantine attributes from malicious applications.
Growing Threat Landscape
This discovery represents part of a concerning trend in Mac-targeted malware campaigns. Security researchers have documented increasing sophistication in attacks targeting Apple systems, with threat actors employing unconventional programming languages and advanced evasion techniques to circumvent traditional detection methods.
The exploitation of legitimate-seeming services like PDF converters reflects a broader shift in cybercriminal tactics.
Similar campaigns have been documented using fake websites that clone popular services, complete with realistic loading screens and CAPTCHA verifications to establish user trust before deploying malicious payloads.
The emergence of JSCoreRunner underscores the critical importance of multi-layered security approaches for Mac environments.
While Apple’s built-in protections like Gatekeeper and XProtect provide baseline security, the success of this malware’s second-stage deployment demonstrates the need for additional security measures.
Mosyle’s detection of this zero-day threat highlights the value of specialized Apple security solutions that can identify novel attack vectors.
The company’s Security Research team continues to monitor evolving threats specifically targeting Mac environments, providing crucial intelligence for the broader cybersecurity community.
Protection Recommendations
Cybersecurity experts emphasize several key protective measures for Mac users. Primary recommendations include avoiding random search results for online file conversion tools and exclusively using verified, official websites for such services.
Additionally, organizations should implement comprehensive endpoint detection solutions capable of identifying novel malware families.
For system administrators, the provided hash signatures enable proactive blocking and detection of JSCoreRunner components across managed Mac environments.
Regular security awareness training should emphasize the risks associated with free online conversion tools and the importance of verifying software sources before installation.
The JSCoreRunner campaign serves as a stark reminder that Mac users can no longer assume immunity from sophisticated malware attacks, particularly as cybercriminals continue developing increasingly clever social engineering tactics to exploit everyday computing needs.
Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.
