random

In the rapidly growing crypto industry, the widespread adoption of cryptocurrencies has attracted not only legitimate users but also cybercriminals seeking to <a href="https://bitcoinist.com/xenomorph-malware-attacks-us-crypto-community/" target="_blank" rel="noopener ">exploit vulnerabilities</a>.&nbsp; 
Recent findings from cybersecurity firm Kaspersky shed light on a sophisticated malware attack targeting Macbook users in the crypto space.&nbsp; 
<h2 id="harvesting-sensitive-data-from-infected-mac-systems">Harvesting Sensitive Data From Infected Mac Systems</h2> 
Kaspersky Lab experts <a href="https://securelist.com/new-macos-backdoor-crypto-stealer/111778/?reseller=sea_regular-sm_acq_ona_smm__onl_b2b_twi_lnk_sm-team______" target="_blank" rel="noopener nofollow">discovered </a>that the attackers repacked pre-cracked applications as Package (PKG) files – a type of file format commonly used on Macbooks – and embedded a Trojan proxy and a post-installation script.&nbsp; 
The malware-laden applications were mainly distributed through pirated software channels. Once users attempted to install the cracked applications, they unknowingly triggered the infection process. 
To <a href="https://bitcoinist.com/new-malware-targets-crypto-wallets/" target="_blank" rel="noopener ">deceive users</a>, the infected installation package displayed a window with installation instructions, instructing them to copy the application to the /Applications/ directory and launch an application called “Activator.”&nbsp; 
<img loading="lazy" decoding="async" class="size-large wp-image-276540" src="https://bitcoinist.com/wp-content/uploads/2024/01/Screenshot_29.jpg?w=870&amp;resize=870%2C399" alt="Crypto" width="870" height="399" srcset="https://bitcoinist.com/wp-content/uploads/2024/01/Screenshot_29.jpg?w=870&amp;resize=870%2C399 870w, https://bitcoinist.com/wp-content/uploads/2024/01/Screenshot_29.jpg?w=640 640w, https://bitcoinist.com/wp-content/uploads/2024/01/Screenshot_29.jpg?w=768 768w, https://bitcoinist.com/wp-content/uploads/2024/01/Screenshot_29.jpg?w=750 750w" sizes="(max-width: 870px) 100vw, 870px" data-recalc-dims="1"> 
Although appearing unsophisticated at first glance, Activator prompted users to enter a password, effectively granting the malware administrator privileges. 
Upon execution, the malware checked the system for an installed copy of the programming language <a href="https://bitcoinist.com/new-atomic-malware-on-macos-targets-crypto-wallets/" target="_blank" rel="noopener ">Python 3</a> and, if absent, installed a previously copied version of Python 3 from the Macbook operating system directory.&nbsp; 
The malware then ” patched” the downloaded app by comparing the modified executable with a sequence hardcoded inside Activator. If a match was found, the malware removed the initial bytes, making the application appear cracked and functional to the user. However, the true intentions of the attackers became apparent as the malware initiated its main payload.&nbsp; 
The infected sample established communication with a command-and-control (C2) server by generating a unique Uniform Resource Locator (URL), or web address, through a combination of hardcoded words and a random third-level domain name.&nbsp; 
This method allowed the malware to conceal its activities within normal DNS server traffic, ensuring the payload download. 
The <a href="https://bitcoinist.com/spider-man-no-way-home-fans-this-crypto-malware/" target="_blank" rel="noopener ">decrypted script </a>obtained from the C2 server – a remote server or infrastructure used by cybercriminals to control and manage their malware or botnet operations – revealed that the malware operated by executing arbitrary commands received from the server. These commands were often delivered as Base64-encoded Python scripts. 
Furthermore, the malware harvested sensitive information from the infected system, including the operating system version, user directories, list of installed applications, CPU type, and external IP address. The gathered data was then sent back to the server. 
<h2 id="malware-campaign-targets-crypto-wallet-applications">Malware Campaign Targets Crypto Wallet Applications</h2> 
While analyzing the malware campaign, Kaspersky observed that the C2 server did not return any commands during their investigation and eventually stopped responding.&nbsp; 
However, subsequent attempts to download the third-stage Python script led to the discovery of updates in the script’s <a href="https://bitcoinist.com/kyberswap-exploit-50-million-loss/" target="_blank" rel="noopener ">metadata</a>, indicating ongoing development and adaptation by the malware operators. 
Additionally, the malware contained functions specifically targeting popular crypto wallet applications, such as Exodus and Bitcoin-Qt.&nbsp; 
If these applications were detected on the infected system, the malware attempted to replace them with infected versions obtained from a different host, apple-analyzer [.]com.&nbsp; 
These infected crypto wallets included mechanisms to steal wallet unlock passwords and secret recovery phrases from unsuspecting users. 
The cybersecurity firm emphasized that<a href="https://bitcoinist.com/crypto-casino-stake-hit-in-40-million-exploit/" target="_blank" rel="noopener "> malicious actors continue</a> to distribute cracked applications&nbsp;to gain access to users’ computers.&nbsp; 
By exploiting user trust during software installation, attackers can easily escalate their privileges by prompting users to enter their passwords. Kaspersky also highlighted the techniques employed by the malware campaign, such as storing the Python script inside a domain TXT record on a DNS server, demonstrating the “ingenuity” of the attackers. 
<img loading="lazy" decoding="async" class="size-large" src="https://www.tradingview.com/x/dhNAuUkN/" alt="Crypto" width="1814" height="858"> 
Featured image from Shutterstock, chart from TradingView.com

Macbook Crypto Users Targeted By Advanced Malware Attack, Cybersecurity Firm Warns

Table of Contents

Bitcoinist

Other articles published on Jan 24, 2024

Bitfinex Securities hasn't seen a single trade in two months

Franklin Templeton Confident in Spot Bitcoin ETF’s Future, Awaits Advisor Familiarity

3 Reasons Why Pandoshi (PAMBO) Will Replace Dogecoin (DOGE)

MANTA jumps 27%, SUI up by 15% in much-needed relief rally

Bitcoin’s Potential Downtrend: Expert Analysis and Market Signals

Meme Token TRUMP Sent to Donald Trump-Branded Crypto Wallet Now Worth Over $1.1 Million

Join our free newsletter for daily crypto updates!