Yes, What you hear is something mysterious that the .EXE file runs on macOS is totally new right. but this strange activity uncovered by security researchers that, an EXE files in the wild delivering a malicious payload on Mac.
It is not only launching the malware but the .exe file is capable of bypass the mac security mechanism such as Gatekeeper.
Basically, EXE files format is an official and dedicated windows file format that wont be able to run on Linux, macOS, but if it tries to run on it then both OS will throw the error message.
In this case, new .EXE file routine evades the Gatekeeper protection on Mac because it checks only native Mac files but it will not checking the EXE and bypasses the signature detection and verification.
This is new malware attack mostly learn from the countries such as
United Kingdom, Australia, Armenia, Luxembourg, South Africa and the United States.
Researchers found “Little Snitch” An installer of popular firewall app
that can be downloaded from various torrent websites for Mac and windows .
Once extracted the Zip File. Some of the Zipped .NET compiled Windows executable sample which contains a .DMG file hosting the installer for Little Snitch.
Later analysing the installer contents, researchers found the very unusual
.EXE file inside of the MonoBundle that is eventually responsible for the malicious payload.
Mono Bundle turn your Mono application into a Mac bundle, and you can also get a Mac installer for your application.
According to Trend Micro, “When the installer is executed, the main file also launched the executable as it is enabled by the mono framework included in the bundle. This framework allows the execution of Microsoft .NET applications across platforms such as OSX. “
Once the .DMG files are ready then it popup the adware that posed as a legitimate flash player installer and also PUAs displayed when the file is run.
This specific malicious .EXE file was tired attempt to execute in the windows machine but it displays the error.
“The bundling of the files with the said framework becomes a workaround to bypass the systems given EXE is not a recognized binary executable by MacOS’ security features. As for the native library differences between Windows and MacOS, mono framework supports DLL mapping to support Windows-only dependencies to their MacOS counterparts.” Trend Micro Researchers said.
A new Cactus Ransomware was exploited in the code execution vulnerability to Qlik Sense for initial access. Qlik Sense is…
The ScrubCrypt obfuscation tool has been discovered to be utilized in attacks to disseminate the RedLine Stealer malware, and its new variant was being marketed in…
According to a recent report by Secureworks, a well-planned and advanced phishing attack was carried out, specifically targeting hotels and…
Zoom, the most widely used video conferencing platform has been discovered with a critical vulnerability that threat actors could potentially…
Hackers use weaponized invoices to exploit trust in financial transactions, embedding malware or malicious links within seemingly legitimate payment requests. …
The U.S. Treasury Department sanctioned the famous cryptocurrency mixer Sinbad after it was claimed that the North Korean hacker group…