Tag

Macos Malware

All articles tagged with #macos malware

technology1 day ago•4 min saved

CrashStealer macOS infostealer fakes Apple’s crash reporter to swipe credentials and crypto wallets

A new macOS information-stealing malware named CrashStealer disguises itself as Apple’s CrashReporter to harvest Keychain data, browser credentials, and more than 80 crypto wallet extensions. Delivered via a signed, Apple-notarized dropper and launched with a fake system prompt, it exfiltrates encrypted data (AES-256-GCM) to a C2 server after collecting files from user directories. Researchers note its stealthy, self-re-signing persistence and its distinct client-side encryption and native C++ implementation, with the campaign gated behind a PIN and active since May 2026.

via BleepingComputer|

#crashstealer #crypto-wallets #infostealer

cybersecurity2 years ago•3 min saved

"RustDoor: New macOS Malware Linked to Ransomware Groups"

A new Rust-based macOS malware, known as RustDoor, is being distributed as a fake Visual Studio update and provides backdoor access to compromised systems. The malware communicates with command and control servers linked to the ALPHV/BlackCat ransomware gang, potentially indicating a connection to ransomware operations. It is primarily distributed as an updater for Visual Studio for Mac and has been undetected for at least three months. RustDoor has the capability to control compromised systems, exfiltrate data, and establish persistence by modifying system files, using commands such as shell execution, file manipulation, and process termination.

via BleepingComputer|

#backdoor #cybersecurity #macos-malware

malware-cyber-espionage2 years ago•1 min saved

North Korean Hackers Employ Blended macOS Malware Tactics to Elude Detection

North Korean hackers associated with the Lazarus Group are combining different elements of their macOS malware campaigns, using RustBucket droppers to deliver the KANDYKORN malware. Cybersecurity firm SentinelOne has linked a third macOS-specific malware called ObjCShellz to the RustBucket campaign. The Lazarus Group is utilizing a backdoored version of a PDF reader app, SwiftLoader, to distribute KANDYKORN, demonstrating the evolving and collaborative nature of North Korean cyber threats. This tactic makes it challenging for defenders to track and attribute malicious activities. Additionally, a subgroup within Lazarus, Andariel, has been implicated in cyber attacks exploiting a security flaw in Apache ActiveMQ.

via The Hacker News|

#kandykorn #lazarus-group #macos-malware