2024

Connect

Apple

Read

Kaspersky urges MacOS users to be cautious, steer clear of dubious websites, and employ reliable cybersecurity measures in response to a new malware targeting MacOS versions 13.6 and higher. 
The malware, discovered by the cybersecurity firm, is particularly dangerous as it aims to deceive Bitcoin and Exodus wallet users into downloading a fake, malicious version of their software. 
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper"> 
 <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
 Our experts review a new <a href="https://twitter.com/hashtag/macOS?src=hash&amp;ref_src=twsrc%5Etfw" target="_blank" rel="noopener">#macOS</a> backdoor exploiting cracked software, targeting <a href="https://twitter.com/hashtag/Bitcoin?src=hash&amp;ref_src=twsrc%5Etfw" target="_blank" rel="noopener">#Bitcoin</a> &amp; <a href="https://twitter.com/hashtag/Exodus?src=hash&amp;ref_src=twsrc%5Etfw" target="_blank" rel="noopener">#Exodus</a> wallets. This malicious software replaces the wallets with <a href="https://twitter.com/hashtag/malware?src=hash&amp;ref_src=twsrc%5Etfw" target="_blank" rel="noopener">#malware</a>, deploying a potent backdoor running scripts with admin privileges. Full report ⇒ <a href="https://t.co/eJXIdp9n3b" target="_blank">https://t.co/eJXIdp9n3b</a> <a href="https://t.co/5Kw0ppUZYg" target="_blank">pic.twitter.com/5Kw0ppUZYg</a>— Kaspersky (@kaspersky) <a href="https://twitter.com/kaspersky/status/1749421566415208649?ref_src=twsrc%5Etfw" target="_blank" rel="noopener">January 22, 2024</a>
 </blockquote>
 <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
 </div>
</figure> 
According to Kaspersky, the newly discovered malware spreads through pirated applications, diverging from usual proxy trojans or remote control software by specifically targeting wallet applications. 
<blockquote class="wp-block-quote"> 
 “Cybercriminals […] realize that an individual looking for a cracked app will be willing to download an installer from a questionable website and disable security on their machine, and so they will be fairly easy to trick into installing malware as well.” 
</blockquote> 
The Trojan in question stands out by using DNS records to deliver a malicious Python script, a method unseen in previous attacks. 
Remarkably, this <a href="https://crypto.news/tag/malware/">malware </a>doesn’t just steal crypto wallet data; it replaces the actual wallet application with a counterfeit version. This allows the attackers to gain access to the secret phrases needed to access the cryptocurrencies stored within these wallets. 
The threat is reported to target macOS versions 13.6 and above, regardless of whether they are running on Intel or Apple Silicon hardware. 
 You might also like: <a href="https://crypto.news/north-korea-targets-blockchain-engineers-with-new-macos-malware/"> North Korea targets blockchain engineers with new macOS malware </a> 
Sergey Puzan, a security researcher at Kaspersky, notes the innovative approach of hiding a Python script within a DNS server’s record, which makes the malware harder to detect in network traffic. He advises users to exercise extreme caution with their cryptocurrency wallets, recommending downloading from trusted sources like the Apple App Store, keeping operating systems updated, and employing security solutions as key practices to minimize risk. 
The latest malware threat is part of a larger trend of increasing<a href="https://crypto.news/north-korean-crypto-hackers-raided-600m-in-2023/"> cyber-attacks focused on cryptocurrency</a>. For instance, North Korean hackers have been using sophisticated deception tactics, including <a href="https://crypto.news/dprk-hackers-impersonate-south-korean-officials-to-steal-crypto/">impersonating journalists and government agencies</a>, to gain access to Bitcoin wallets. 
In an incident reported by crypto.news in November 2023, these hackers managed to deceive 19 victims, leading to significant theft of cryptocurrencies. 
Furthermore, in June of the same year, Elliptic Connect reported that the Lazarus group, tied to North Korea, <a href="https://crypto.news/stolen-crypto-from-atomic-wallet-traced-to-north-korean-linked-mixer/">stole over $35 million</a> in various cryptocurrencies, including USDT, XRP, Cardano, and Dogecoin, from users of Atomic Wallet. 
 Read more: <a href="https://crypto.news/us-south-korea-japan-north-korea-cyberattacks/"> US, South Korea and Japan collaborate to tackle North Korea cyberattacks </a>

Kaspersky warns of new MacOS malware aiming at crypto wallets

crypto.news

Other articles published on Jan 23, 2024

Pushd (PUSHD) Could Be The Next Amazon! Cardano (ADA) And Avalanche (AVAX) Fall In Value

Bitcoin Faces Critical Support as Momentum Slows, Analyst Shares Next Target To Buy BTC

FTX Token Price Prediction: FTT Surges 12%, But Investors Turn To This AI Presale With Only Hours...

3M’s (MMM) Strong Q4 Performance: EPS Hits $2.31, Outshining Revenue Projections

SEC Commissioner: Ethereum ETF approvals won’t be same as Bitcoin

If this Bitcoin Pattern Holds, BTC is Going Down to $32k

Join our free newsletter for daily crypto updates!