Atomic Stealer Mac malware: New malware for macOS

Atomic Stealer Mac malware: a new malware variant for macOS.

4 Mac Malware Finds in 2022

Mac malware in 2022: An overview of four important macOS malware variants found in 2022 and tips on staying safe.

GravityRAT Windows malware has new macOS variant

Security researchers have just announced the discovery of Android and macOS variants of GravityRAT, a Windows spyware threat that’s been around since at least 2016.

FinSpy spyware for macOS discovered

Researchers at Amnesty International have just announced the discovery of FinSpy spyware variants that target macOS and Linux users. In this article, we’ll tell you what they found, share some technical details uncovered by Amnesty’s malware analysts, and explain what it means for security and privacy.

What is FinSpy?

FinSpy is commercial spyware, produced by a private company and sold to law enforcement and intelligence agencies around the world. There are (arguably) legitimate uses of such monitoring software, for example in criminal and anti-terrorism investigations; however, FinSpy’s manufacturers have come under fire …

XCSSET: New Mac malware infects Xcode projects

Security researchers have discovered an interesting new variety of macOS malware that spreads by attacking Xcode projects. It’s called XCSSET, and in this article, we’ll tell you what you need to know about this unusual threat in order to stay safe.

What is XCSSET?

XCSSET is a suite of malicious components that spreads through infected Xcode projects.

Xcode is a tool used by app developers to write software for Apple platforms. An Xcode “project” simply refers to the repository of files, information, and resources that are used to build an app for deployment.

If …

LightSpy: APT malware for iOS

Security researchers have discovered a new form of iOS malware that they’ve dubbed LightSpy affecting both iOS and Android.

New fileless malware for macOS linked to Lazarus Group

The new malware sample bears similarities to the well-known AppleJeus malware, which targets cryptocurrency exchanges. AppleJeus is the product of Lazarus Group, a shadowy cybercrime organization believed by many to be linked to North Korea.

Police Can Now Access iPhone Data Using a Secretive Piece of Hardware

For several years now, a fierce debate has raged over how much access law enforcement organizations (LEOs) should be able to have to the mobile devices of those suspected of a crime. The issue made nationwide headlines after the San Bernardino attacks in 2015, when the FBI grappled with how to break into an iPhone used by one of the perpetrators. While the FBI did eventually retrieve device data by utilizing an unknown group to gain access to the phone’s encrypted contents, law enforcement agencies, in general, have maintained that they must have a “backdoor” to access info secured by your iPhone passcode. Apple has steadfastly refused to give in to such demands, but it appears that for now, those refusals don’t matter: LEOs can now use a pricey piece of hardware called GrayKey.

Recent Downloads from Eltima Software Were Infected with Malware

If you recently downloaded Elmedia Player or Folx—two Mac OS X programs from German-based developer Eltima Software—then your Mac may be infected with malware. According to a report from ZDNet, hackers recently managed to breach the Eltima Software servers. The hackers bundled Elmedia Player and Folx with a Mac OS X Trojan called Proton.

Elmedia Player is a popular media player app that Eltima says is capable of recognizing “any file format you probably may think of.” The app also allows for HD video playback with no slowdowns and …

Ransomware Attacks Target Apple Users Via iCloud

A recent rash of ransomware attacks has left some Apple users locked out of their Mac computers and iOS devices. The nature of the attacks led some users to wonder if Apple itself had suffered some kind of hack. The good news is that the situation does not appear to be an Apple hack. The bad news is that hackers have somehow managed to get their hands-on login credentials for some users.

Hackers are attacking users by logging into their iCloud accounts and enabling the “Find My iPhone” function. …

Another Ransomware Attack Spreads Around the Globe

At the end of June, the world awoke to another widespread ransomware attack locking down machines across the globe. This time, the bulk of the attack centered on Ukraine, although countries such as Germany, the UK, and the USA also saw infections. Initially, the media reported that this was an attack executed by ransomware known as “Petya.” Petya was originally discovered and detailed back in 2016, spreading through infected emails and employing the typical demand of a ransom paid in Bitcoin.

The attacks of June 27, however, were very …

WannaCry Locked Down Australian Traffic Cameras, Caused Voided Citations

Do you think that ransomware attacks only affect personal computers and business systems? Think again — the recent widespread infections caused by the WannaCry ransomware touched more than just hospitals in the UK and unpatched Windows PCs. In the Australian state of Victoria, hundreds of traffic cameras, meant to enforce speed limits, were knocked offline after the malware infected the system. Instead of encrypting data for ransom, the system instead became locked in a continuous cycle of rebooting.

Because of the infection, police in Victoria announced that they would …

Ransomware on the Rise: What Should You Know?

After the massive outbreak of the WannaCry malware that took down hospitals in the UK and spread around the world, we knew it was only a matter of time before similar attacks took place. With the recent outbreak of new ransomware, dubbed Petya, affecting computers in Ukraine and spreading to other countries, it’s a good time to take a step back and look at some hard facts about ransomware. What do Mac users need to know about this rising threat?

Who does ransomware affect?

Windows users are the ones who …

Darkweb Hackers Begin Offering Functional Mac Malware and Ransomware as a...

With the popularity of both ransomware and the creation of macOS malware on the rise with hackers, Apple users face a growing number of threats. It now appears that others have turned their attention to the creation of new malware to spy on Mac users — but these programmers have gone a step further. Rather than developing a tool and deploying it personally, they have taken to the dark web to offer their products for sale. Known respectively as MacSpy and MacRansom, the hackers provide the malware to users …

Compromised Download Server Infects Handbrake Users with Malware

People with an extensive DVD or Blu-Ray collection can enjoy a wide variety of media at home, but what happens when you want to take it with you? The simple solution is to “rip” your favorite DVDs to create digital media files you can play back on your MacBook, or perhaps store on your home media server. Many Mac users dabble with this. Most people use the popular software, Handbrake, to digitize their media. Unfortunately, hackers recently compromised one of Handbrake’s download servers. For four days, an unknown quantity …

New Malvertising Campaign Targets iOS Users with Data-Hoarding VPN

With the huge volume of ads displayed on sites across the Web today, it’s no surprise that bad actors view them as a window to reach vulnerable users. A new malvertising threat has appeared for iOS users. This time, it’s not about infecting your iOS devices directly — instead, it’s designed to coerce users into installing software that monitors and tracks their online activities. It does this by masquerading as a VPN, or virtual private network. VPNs are often useful for providing yourself with greater privacy protections while browsing …

Allegedly “Undetectable” Malware Offered for Hefty Darknet Price

Though many of its now-famous hidden marketplaces have been taken down by law enforcement, the darknet continues to be a home for the web’s seediest characters. The latest item to hit the market and generate buzz isn’t an illegal substance — instead, it’s illegal software. Several outlets have reported that an anonymous darknet user is currently making attempts to sell an allegedly unreleased “remote administration tool,” or RAT, for Macs.

Dubbed “Proton,” when installed this software gives attackers full control over a user’s machine. That includes downloading more …

Iranian Malware Targets User Passwords in the macOS Keychain

A brand-new type of malware affecting Macs is in the wild, and this time there are definite signs of development in conjunction with a foreign nation. Designed (albeit rather poorly) to look like a Flash update, this malware, dubbed MacDownloader, is a unsophisticaed attempt to glean user passwords. Uncovered by security researchers after the malware targeted major defense contractors, the program may feature amateurish code, but its threat is very real.

After fooling a user into downloading the false Flash update, the malware quickly goes to work profiling the …

Newly-Discovered “Fruitfly” Backdoor Allows Remote Access to Macs

The latest item of Mac malware to be uncovered is actually not new at all; in fact, it may have been around for several years. Dubbed “Fruitfly” by Apple, this malware has some novel features. In particular, its function depends upon using both an outdated library from the late 90s, libjpeg, as well as pre-OS X system calls. Why the malware was designed to use outdated methods is unknown, but in the wake of the malware’s discovery, Apple promptly issued an update to XProtect to reduce the threat to users. …

Ransomware Imitation Attempts to Fool iPhone Users

Though the threat of computer viruses once lurked primarily in the domain of email attachments and suspicious file downloads, the current landscape is vastly different. Simply doing damage to a system and spreading a virus further is no longer the biggest threat. From spyware to any of the many flavors of malware, there are many new and evolving security issues facing computer systems globally. Ransomware continues its rise to prevalence as infections rise year over year, compromising more machines. Ransomware, a type of malware which locks down user access to …