Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label macOS. Show all posts
macOS
AI Chatbot AI Security Axios ChatGPT. OpenAI Cyber Attacks Digital Supply Chain Risk macOS

OpenAI Tightens macOS Security After Axios Supply Chain Attack and Physical Threat Incident

 

Security updates rolled out by OpenAI for macOS apps follow discovery of a flaw tied to the common Axios library. Because of risks exposed through a software supply chain breach, checks on app validation tightened noticeably. One outcome: stronger safeguards now guide distribution methods across desktop platforms. Verification steps increased where imitation attempts once slipped through. The company says the hacked Axios package entered a dev process via an automated pipeline, possibly revealing key signing methods tied to macOS app authentication. 

Though worries emerged over software trustworthiness, OpenAI stated no signs exist of leaked user information, breached internal networks, or tampering with its source files. Starting May 8, older versions of OpenAI’s macOS apps will no longer be supported. Updates are now mandatory, not optional. The shift pushes users toward newer releases as a way to tighten defenses. Functionality depends on using recent builds - this cuts openings for tampering. Fake or modified copies become harder to spread when outdated clients stop working. 

Security improves when only authenticated software runs. Protection rises when unverified versions fade out. Keeping systems current closes gaps exploited by malicious actors. Outdated installations pose higher risk, so access ends automatically. Upgraded versions meet stricter validation standards. Support withdrawal isn’t arbitrary - it aligns with safety priorities. 

Continued operation requires compliance with updated requirements. It could be part of a broader pattern - security incidents tied to groups connected with North Korea have recently focused on infiltrating software development environments through indirect routes. Instead of breaking into main platforms, attackers often manipulate components already trusted within workflows. This shift toward subtle intrusion methods has made early identification more difficult. Detection lags because weaknesses hide inside approved tools. 

One sign points to coordinated efforts stretching across multiple targets. The method avoids obvious entry, favoring quiet access over force. Compromised updates act like unnoticed messengers. Such strategies thrive where verification is light. Hidden flaws emerge only after deployment. Trust becomes the weak spot. Observers note similar tactics appearing elsewhere in recent breaches. Indirect pathways now draw more attention than frontal assaults. Stealth matters more than speed. Systems appear intact until downstream effects surface. Monitoring grows harder when threats arrive disguised as normal operations. 

Besides digital safety issues, OpenAI now faces growing real-world dangers. In San Francisco, law enforcement took someone into custody after a suspected firebomb was thrown close to Chief Executive Sam Altman’s home, followed by further warnings seen near corporate offices. Though nobody got hurt, the events point to rising friction tied to artificial intelligence development. OpenAI collaborates with authorities, addressing risks across online and real-world domains. Strengthening internal safeguards remains an ongoing effort, shaped by evolving challenges. 

Instead of waiting for incidents, recent steps like requiring updated macOS versions aim to build confidence in their systems. This move comes before any verified leaks occur - its purpose lies in prevention, not damage control. OpenAI pushes further into business markets right now, with growing income expected from ad tech powered by artificial intelligence along with corporate offerings. 

At the same time, efforts such as the “Trained Access for Cyber” project move forward, delivering advanced cybersecurity tools driven by machine learning to carefully chosen collaborators. Still, the event highlights how today's cyber threats are becoming harder to manage, as flaws in shared software meet tangible dangers in practice. 

Notably, OpenAI’s actions follow a wider trend across tech - companies now prioritize tighter checks, quicker updates, sometimes reworking entire defenses before problems spread.
Read more »
Windows
Axios Data Breach http library macOS malicious npm package social engineering attacks supply chain attacks Windows

Axios npm Breach Exposes Threat of Social Engineering Attacks on Open-Source Ecosystem

 



A security incident involving the widely used Axios HTTP library has revealed how attackers are increasingly targeting software maintainers themselves, rather than exploiting code vulnerabilities, to carry out large-scale supply chain attacks.

The issue came to light after Axios maintainers disclosed that an attacker gained access to a contributor’s npm account and used it to publish two compromised versions of the package, 1.14.1 and 0.30.4. These releases included a hidden dependency named plain-crypto-js, which deployed a remote access trojan across macOS, Windows, and Linux systems.

Although the malicious packages were available for only about three hours before being removed, the short exposure window does not reduce the severity. Any system that installed these versions is now considered unsafe. Users have been advised to immediately rotate all credentials, revoke authentication tokens, and assume full compromise of affected environments.

The Axios team confirmed that they have since secured their infrastructure by resetting credentials, cleaning impacted machines, and introducing additional safeguards to prevent similar incidents.

Further investigation by Google Threat Intelligence Group linked the activity to a North Korea-associated threat actor identified as UNC1069. This group, active since at least 2018, is believed to be financially motivated. Attribution was based on malware similarities, including the use of an updated toolset previously tied to the group, as well as overlaps in command-and-control infrastructure observed in earlier operations.


Social Engineering as the Entry Point

The compromise did not begin with a technical flaw. Instead, it started weeks earlier with a carefully orchestrated social engineering attack targeting Axios maintainer Jason Saayman.

Attackers posed as a legitimate organization by replicating its branding, leadership identities, and communication style. They invited the target into what appeared to be a genuine Slack workspace. This environment was not hastily assembled. It contained multiple channels, staged conversations, and curated activity, including links that redirected to real company LinkedIn profiles. Fake user accounts were also created to impersonate employees and known open-source contributors, increasing credibility.

After establishing trust, the attackers scheduled a video meeting that appeared to involve several participants. During the session, the target was shown what looked like a technical issue, specifically a connection-related error. He was then instructed to install an update presented as necessary to resolve the problem.

In reality, this “update” was malicious software that granted the attackers remote access to the system. Once inside, they were able to extract authentication credentials linked to the npm account.


Repeated Tactics Across Multiple Targets

Other maintainers later reported nearly identical experiences. In several cases, attackers attempted to persuade targets to install what they described as a Microsoft Teams software development kit update. When that approach failed, they escalated their efforts by asking victims to execute command-line instructions, including downloading and running scripts via Curl commands.

One such target, Pelle Wessman, described how attackers abandoned the interaction and deleted all communication after he refused to comply.

These methods align with a broader category of attacks sometimes referred to as “ClickFix” techniques, where victims are misled into resolving fake technical issues that ultimately result in malware execution.


Bypassing Security Controls

Because the attackers gained access to already authenticated sessions, they were able to bypass multi-factor authentication protections. This highlights a critical limitation of MFA, which is effective against credential theft but less effective once an active session is compromised.

Importantly, the attackers did not modify Axios’s source code directly. Instead, they inserted a malicious dependency into legitimate package releases, making the compromise significantly harder to detect during routine checks.


A Coordinated Supply Chain Campaign

Research from Socket indicates that this incident is part of a broader, coordinated campaign targeting maintainers across the Node.js ecosystem. Multiple developers, including contributors to widely used packages and even core components, reported receiving similar outreach messages through platforms such as LinkedIn and Slack.

The attackers followed a consistent pattern: initial contact, trust-building within controlled communication channels, followed by staged video calls where victims were prompted to install software or run commands under the pretense of fixing technical issues.

The scale of targeting is particularly concerning. Many of the developers approached are responsible for packages with billions of weekly downloads, meaning a single compromised account can have far-reaching consequences across the global software ecosystem.


Future Outlook 

This incident surfaces a new course in attacker strategy. Rather than focusing solely on software vulnerabilities, threat actors are increasingly exploiting human trust within high-impact projects. Open-source software, which underpins much of today’s digital infrastructure, becomes an attractive target due to its widespread adoption and reliance on maintainers.

Security experts warn that such attacks are likely to increase in frequency. Protecting against them will require not only technical safeguards, but also stronger operational discipline, including stricter access controls, hardware-based authentication, and heightened awareness of social engineering tactics.

The Axios breach ultimately demonstrates that in modern supply chain attacks, the weakest link is often not the code, but the people who maintain it.

Read more »
Malware attacks
Axios Cyber Security Cyberattacks Deceptive npm packages Global Supply Chain Security macOS Malware attacks

Axios Supply Chain Attack Exposes npm Security Gaps with Token-Based Compromise

 

A breach in the Axios library - one of many relied upon in modern web development - has exposed flaws that linger beneath surface-level fixes. Through stolen access, hackers slipped harmful updates into what users assumed was safe code. This event underscores how fragile trust can be, even when systems claim stronger defenses. Progress in verifying packages and securing logins appears incomplete, given such exploits still succeed. Confidence in tools like those hosted on npm remains shaken by failures that feel both avoidable and familiar. 

A lead developer’s extended-use npm token was accessed by hackers, reports show from Huntress and Wiz. Through this entry point, altered builds of Axios emerged - versions laced with hidden code deploying a multi-system remote control tool. Not limited to one environment, the harmful update reached machines running on macOS, Windows, or Linux setups. Lasting just under three hours, the rogue releases stayed active online until taken down. 

Axios ranks among the top tools in JavaScript, downloaded more than a hundred million times each week, found in roughly eight out of ten cloud setups. Moments after the tainted update went live, malware started spreading fast; Huntress later verified infection on 135 machines while the vulnerability was active. Hidden within a third-party addition, plain-crypto-js slipped into Axios’s environment without touching its main codebase. Not through direct changes but via a concealed payload activated after installation. 

Running quietly once set up, it triggered deployment of a remote access tool on developers’ systems. Built to avoid notice, the malicious code erased itself under certain conditions. Altered components were restored automatically, masking traces left behind. One reason this breach stands out lies in its method - evading defenses thought secure. Even after adopting standard safeguards like OIDC for verified publishing and robust supply chain models, outdated tools remained active. 

A leftover npm access key opened the door despite stronger systems being in place. Where two login paths existed, preference went to the original token, rendering recent upgrades useless under that condition. This is now the third significant breach of the npm supply chain in just a few months, after events such as the Shai-Hulud incident. 

Each time, hackers used compromised maintainer login details to gain access, revealing a recurring weakness across the system. Though security professionals highlight benefits of measures like multi-factor verification and origin monitoring, these fail to block every threat when login data is exposed. 

With growing pressure, companies must examine third-party links, apply tighter rules on software setup, yet phase out outdated access methods instead. When trust rests on open-source tools, weaknesses in how credentials are handled can still invite breaches. A single event shows flaws aren’t always in the code itself - sometimes they hide where access is managed.
Read more »
Trojan
coding GitHub JavaScript macOS malware Microsoft Node.js North Korean Hackers Trojan

North Korean Hackers Turn VS Code Projects Into Silent Malware Triggers

 


Opening a project in a code editor is supposed to be routine. In this case, it is enough to trigger a full malware infection.

Security researchers have linked an ongoing campaign associated with North Korean actors, tracked as Contagious Interview or WaterPlum, to a malware family known as StoatWaffle. Instead of relying on software vulnerabilities, the group is embedding malicious logic directly into Microsoft Visual Studio Code (VS Code) projects, turning a trusted development tool into the starting point of an attack.

The entire mechanism is hidden inside a file developers rarely question: tasks.json. This file is typically used to automate workflows. In these attacks, it has been configured with a setting that forces execution the moment a project folder is opened. No manual action is required beyond opening the workspace.

Research from NTT Security shows that the embedded task connects to an external web application, previously hosted on Vercel, to retrieve additional data. The same task operates consistently regardless of the operating system, meaning the behavior does not change between environments even though most observed cases involve Windows systems.

Once triggered, the malware checks whether Node.js is installed. If it is not present, it downloads and installs it from official sources. This ensures the system can execute the rest of the attack chain without interruption.

What follows is a staged infection process. A downloader repeatedly contacts a remote server to fetch additional payloads. Each stage behaves in the same way, reaching out to new endpoints and executing the returned code as Node.js scripts. This creates a recursive chain where one payload continuously pulls in the next.

StoatWaffle is built as a modular framework. One component is designed for data theft, extracting saved credentials and browser extension data from Chromium-based browsers and Mozilla Firefox. On macOS systems, it also targets the iCloud Keychain database. The collected information is then sent to a command-and-control server.

A second module functions as a remote access trojan, allowing attackers to operate the infected system. It supports commands to navigate directories, list and search files, execute scripts, upload data, run shell commands, and terminate itself when required.

Researchers note that the malware is not static. The operators are actively refining it, introducing new variants and updating existing functionality.

The VS Code-based delivery method is only one part of a broader campaign aimed at developers and the open-source ecosystem. In one instance, attackers distributed malicious npm packages carrying a Python-based backdoor called PylangGhost, marking its first known propagation through npm.

Another campaign, known as PolinRider, involved injecting obfuscated JavaScript into hundreds of public GitHub repositories. That code ultimately led to the deployment of an updated version of BeaverTail, a malware strain already linked to the same threat activity.

A more targeted compromise affected four repositories within the Neutralinojs GitHub organization. Attackers gained access by hijacking a contributor account with elevated permissions and force-pushed malicious code. This code retrieved encrypted payloads hidden within blockchain transactions across networks such as Tron, Aptos, and Binance Smart Chain, which were then used to download and execute BeaverTail. Victims are believed to have been exposed through malicious VS Code extensions or compromised npm packages.

According to analysis from Microsoft, the initial compromise often begins with social engineering rather than technical exploitation. Attackers stage convincing recruitment processes that closely resemble legitimate technical interviews. Targets are instructed to run code hosted on platforms such as GitHub, GitLab, or Bitbucket, unknowingly executing malicious components as part of the assessment.

The individuals targeted are typically experienced professionals, including founders, CTOs, and senior engineers in cryptocurrency and Web3 sectors. Their level of access to infrastructure and digital assets makes them especially valuable. In one recent case, attackers unsuccessfully attempted to compromise the founder of AllSecure.io using this approach.

Multiple malware families are used across these attack chains, including OtterCookie, InvisibleFerret, and FlexibleFerret. InvisibleFerret is commonly delivered through BeaverTail, although recent intrusions show it being deployed after initial access is established through OtterCookie. FlexibleFerret, also known as WeaselStore, exists in both Go and Python variants, referred to as GolangGhost and PylangGhost.

The attackers continue to adjust their techniques. Newer versions of the malicious VS Code projects have moved away from earlier infrastructure and now rely on scripts hosted on GitHub Gist to retrieve additional payloads. These ultimately lead to the deployment of FlexibleFerret. The infected projects themselves are distributed through GitHub repositories.

Security analysts warn that placing malware inside tools developers already trust significantly lowers suspicion. When the code is presented as part of a hiring task or technical assessment, it is more likely to be executed, especially under time pressure.

Microsoft has responded to the misuse of VS Code tasks with security updates. In the January 2026 release (version 1.109), a new setting disables automatic task execution by default, preventing tasks defined in tasks.json from running without user awareness. This setting cannot be overridden at the workspace level, limiting the ability of malicious repositories to bypass protections.

Additional safeguards were introduced in February 2026 (version 1.110), including a second prompt that alerts users when an auto-run task is detected after workspace trust is granted.

Beyond development environments, North Korean-linked operations have expanded into broader social engineering campaigns targeting cryptocurrency professionals. These include outreach through LinkedIn, impersonation of venture capital firms, and fake video conferencing links. Some attacks lead to deceptive CAPTCHA pages that trick victims into executing hidden commands in their terminal, enabling cross-platform infections on macOS and Windows. These activities overlap with clusters tracked as GhostCall and UNC1069.

Separately, the U.S. Department of Justice has taken action against individuals involved in supporting North Korea’s fraudulent IT worker operations. Audricus Phagnasay, Jason Salazar, and Alexander Paul Travis were sentenced after pleading guilty in November 2025. Two received probation and fines, while one was sentenced to prison and ordered to forfeit more than $193,000 obtained through identity misuse.

Officials stated that such schemes enable North Korean operatives to generate revenue, access corporate systems, steal proprietary data, and support broader cyber operations. Separate research from Flare and IBM X-Force indicates that individuals involved in these programs undergo rigorous training and are considered highly skilled, forming a key part of the country’s strategic cyber efforts.


What this means

This attack does not depend on exploiting a flaw in software. It depends on exploiting trust.

By embedding malicious behavior into tools, workflows, and hiring processes that developers rely on every day, attackers are shifting the point of compromise. In this environment, opening a project can be just as risky as running an unknown program.

Read more »
Windows
Audit ClawHub Cyber Attacks macOS Windows

Experts Find Malicious ClawHub Skills Stealing Data from OpenClaw


Koi Security’s security audit of 2,857 skills on ClawHub found 341 malicious skills via multiple campaigns. Users are exposed to new supply chain threats. 

ClawHub is a marketplace made to help OpenClaw users in finding and installing third-party skills. It is a part of the OpenClaw project, a self-hosted artificial intelligence (AI) assistant aka Moltbot and Clawdbot. 

Koi Security's analysis with OpenClaw bot “Alex” revealed that 335 skills use malicious pre-requisite to install an Apple macOS stealer called (Atomic Stealer). The activity goes by the code name ClawHavoc. 

According to Koi research Oren Yomtov, "You install what looks like a legitimate skill – maybe solana-wallet-tracker or youtube-summarize-pro. The skill's documentation looks professional. But there's a 'Prerequisites' section that says you need to install something first.”

Instruction steps:

Windows users are asked to download file “openclaw-agent.zip” from a GitHub repository.

macOS users are asked to copy an installation script hosted at glot[.]io and paste it in the Terminal application. 

Threat actors are targeting macOS users because of an increase in purchase of Mac Minus to use the AI assistant 24x7. 

In the password-protected archive, the trojan has keylogging functionality to steal credentials, API keys, and other important data on the device. Besides this, the glot[.]io script includes hidden shell commands to retrieve next-stage payloads from a threat-actor controlled infrastructure. 

This results in getting another IP address ("91.92.242[.]30") to get another shell script, which is modified to address the same server to get a universal Mach-O binary that shows traits persistent with Atomic Stealer, a commodity stealer that threat actors can buy for $500-1000/month that can extract data from macOS hosts.

The issue is that anyone can post abilities to ClawHub because it is open by default. At this point, the only requirement is that a publisher have a GitHub account that is at least a week old. 

Peter Steinberger, the founder of OpenClaw, is aware of the problem with malicious abilities and has subsequently implemented a reporting option that enables users who are signed in to report a skill. According to the documentation, "Each user can have up to 20 active reports at a time," "Skills with more than 3 unique reports are auto-hidden by default.”


Read more »
Windows
Apple ClickFix macOS Technology Windows

ClickFix Attack Targeting Windows and Mac Users to Steal User Data


“Think before you click”: Microsoft warns all Windows PC users and as well as macOS users, from a series of attacks that are “targeting thousands of enterprise and end-user devices globally every day.”

The scripts deploy malware on these devices, and the “payloads affect Windows and macOS devices,” according to Microsoft, which leads to “information theft and data exfiltration.” The malware, however, can be anything from a type of initial access for ransomware to an entry point for attacking a larger enterprise network.

Initially, ClickFix surfaced as a technical assistance pop-up before moving to Captchas. Fake challenges to use a website are now using a copy, paste, and run command instead of your standard ‘choosing the correct cars and bus’ challenge. The user is instructed to click prompts and copy, paste, and run commands “directly in the Windows Run dialog box, Windows Terminal, or Windows PowerShell,” Microsoft says, and it’s usually blended with “delivery vectors such as phishing, malvertising, and drive-by compromises, most of which even impersonate legitimate brands and organizations to reduce suspicion from their targets further.”

Users should be careful not to run these prompts. You may be lured in various ways that seem innocent, but never copy and paste and run a script in Windows. You can be safe this way. However, as it happens, due to the advancement of these attacks, the awareness part is lacking on the users’ end. 

As ClickFix depends on human prompts to start the malicious commands, it can dodge traditional and automated security checks. Organizations can limit the effect of this tactic by “educating users in recognizing its lures and by implementing policies that will harden device configurations,” Microsoft says.

Microsoft’s latest report provides in-depth details about the various baits and attack techniques cybercriminals are using. According to Microsoft, “A typical ClickFix attack begins with threat actors using phishing emails, malvertisements, or compromised websites to lead unsuspecting users to a visual lure — usually a landing page — and trick them into executing a malicious command themselves.”

Read more »
Windows
Browsers CyberCrime Cybersecurity Digital Data Digital Transformation Linux Linux Security macOS PC Privacy Software VPN Windows

Linux Distribution Designed for Seamless Anonymous Browsing



Despite the fact that operating systems like Windows and macOS continue to dominate the global market, Linux has gained a steady following among users who value privacy and security as well as cybersecurity professionals, thanks to its foundational principles: transparency, user control, and community-based development, which have made it so popular. 

Linux distributions—or distros—are open-source in contrast to proprietary systems, and their source code is freely available to anyone who wishes to check for security vulnerabilities independently. In this way, developers and ethical hackers around the world can contribute to the development of the platform by identifying flaws, making improvements, and ensuring that it remains secure against emerging threats by cultivating a culture of collective scrutiny.

In addition to its transparency, Linux also offers a significant degree of customisation, giving users a greater degree of control over everything from system behaviour to network settings, according to their specific privacy and security requirements. In addition to maintaining strong privacy commitments, most leading distributions explicitly state that their data will not be gathered or monetised in any way. 

Consequently, Linux has not only become an alternative operating system for those seeking digital autonomy in an increasingly surveillance-based, data-driven world, but is also a deliberate choice for those seeking digital autonomy. Throughout history, Linux distributions have been developed to serve a variety of user needs, ranging from multimedia production and software development to ethical hacking and network administration to general computing. 

With the advent of purpose-built distributions, Linux shows its flexibility, as each variant caters to a particular situation and is optimised for that specific task. However, not all distributions are confined to a single application. For example, ParrotOS Home Edition is designed with flexibility at its core, offering a balanced solution that caters to the privacy concerns of both individuals and everyday users. 

In the field of cybersecurity circles, ParrotOS Home Edition is a streamlined version of Parrot Security OS, widely referred to as ParrotSec. Despite the fact that it also shares the same sleek, security-oriented appearance, the Home Edition was designed to be used as a general-purpose computer while maintaining its emphasis on privacy in its core. 

As a consequence of omitting a comprehensive suite of penetration testing tools, the security edition is lighter and more accessible, while the privacy edition retains strong privacy-oriented features that make it more secure. The built-in tool AnonSurf, which allows users to anonymise their online activity with remarkable ease, is a standout feature in this regard. 

It has been proven that AnonSurf offers the same level of privacy as a VPN, as it disguises the IP address of the user and encrypts all data transmissions. There is no need for additional software or configuration; you can use it without installing anything new. By providing this integration, ParrotOS Home Edition is particularly attractive to users who are looking for secure, anonymous browsing right out of the box while also providing the flexibility and performance a user needs daily. 

There are many differences between Linux distributions and most commercial operating systems. For instance, Windows devices that arrive preinstalled with third-party software often arrive bloated, whereas Linux distributions emphasise performance, transparency, and autonomy in their distributions. 

When it comes to traditional Windows PCs, users are likely to be familiar with the frustrations associated with bundled applications, such as antivirus programs or proprietary browsers. There is no inherent harm in these additions, but they can impact system performance, clog up the user experience, and continuously remind users of promotions or subscription reminders. 

However, most Linux distributions adhere to a minimalistic and user-centric approach, which is what makes them so popular. It is important to note that open-source platforms are largely built around Free and Open Source Software (FOSS), which allows users to get a better understanding of the software running on their computers. 

Many distributions, like Ubuntu, even offer a “minimal installation” option, which includes only essential programs like a web browser and a simple text editor. In addition, users can create their own environment, installing only the tools they need, without having to deal with bloatware or intrusive third-party applications, so that they can build it from scratch. As far as user security and privacy are concerned, Linux is committed to going beyond the software choices. 

In most modern distributions, OpenVPN is natively supported by the operating system, allowing users to establish an encrypted connection using configuration files provided by their preferred VPN provider. Additionally, there are now many leading VPN providers, such as hide.me, which offer Linux-specific clients that make it easier for users to secure their online activity across different devices. The Linux installation process often provides robust options for disk encryption. 

LUKS (Linux Unified Key Setup) is typically used to implement Full Disk Encryption (FDE), which offers military-grade 256-bit AES encryption, for example, that safeguards data on a hard drive using military-grade 256-bit AES encryption. Most distributions also allow users to encrypt their home directories, making sure that the files they store on their computer, such as documents, downloads, and photos, remain safe even if another user gets access to them. 

There is a sophisticated security module called AppArmor built into many major distributions such as Ubuntu, Debian, and Arch Linux that plays a major part in the security mechanisms of Linux. Essentially, AppArmor enforces access control policies by defining a strict profile for each application. 

Thus, AppArmor limits the data and system resources that can be accessed by each program. Using this containment approach, you significantly reduce the risk of security breaches because even if malicious software is executed, it has very little chance of interacting with or compromising other components of the system.

In combination with these security layers,and the transparency of open-source software, Linux positioned itself as one of the most powerful operating systems for people who seek both performance and robust digital security. Linux has a distinct advantage over its proprietary counterparts, such as Windows and Mac OS, when it comes to security. 

There is a reason why Linux has earned a reputation as a highly secure mainstream operating system—not simply anecdotal—but it is due to its core architecture, open source nature, and well-established security protocols that it holds this reputation. There is no need to worry about security when it comes to Linux; unlike closed-source platforms that often conceal and are controlled solely by vendors, Linux implements a "security by design" philosophy with layered, transparent, and community-driven approaches to threat mitigation. 

Linux is known for its open-source codebase, which allows for the continual auditing, review, and improvement of the system by independent developers and security experts throughout the world. Through global collaboration, vulnerabilities can be identified and remedied much more rapidly than in proprietary systems, because of the speed with which they are identified and resolved. In contrast, platforms like Windows and macOS depend on "security through obscurity," by hiding their source code so malicious actors won't be able to take advantage of exploitable flaws. 

A lack of visibility, however, can also prevent independent researchers from identifying and reporting bugs before they are exploited, which may backfire on this method. By adopting a true open-source model for security, Linux is fostering an environment of proactive and resilient security, where accountability and collective vigilance play an important role in improving security. Linux has a strict user privilege model that is another critical component of its security posture. 

The Linux operating system enforces a principle known as the least privilege principle. The principle is different from Windows, where users often operate with administrative (admin) rights by default. In the default configuration, users are only granted the minimal permissions needed to fulfil their daily tasks, whereas full administrative access is restricted to a superuser. As a result of this design, malware and unapproved processes are inherently restricted from gaining system-wide control, resulting in a significant reduction in attack surface. 

It is also important to note that Linux has built in several security modules and safeguards to ensure that the system remains secure at the kernel level. SELinux and AppArmor, for instance, provide support for mandatory access controls and ensure that no matter how many vulnerabilities are exploited, the damage will be contained and compartmentalised regardless. 

It is also worth mentioning that many Linux distributions offer transparent disk encryption, secure boot options, and native support for secure network configurations, all of which strengthen data security and enhance online security. These features, taken together, demonstrate why Linux has been consistently favoured by privacy advocates, security professionals, and developers for years to come. 

There is no doubt in my mind that the flexibility of it, its transparency, and its robust security framework make it a compelling choice in an environment where digital threats are becoming increasingly complex and persistent. As we move into a digital age characterised by ubiquitous surveillance, aggressive data monetisation, and ever more sophisticated cyber threats, it becomes increasingly important to establish a secure and transparent computing foundation. 

There are several reasons why Linux presents a strategic and future-ready alternative to proprietary systems, including privacy-oriented distributions like ParrotOS. They provide users with granular control, robust configurability, and native anonymity tools that are rarely able to find in proprietary platforms. 

A migration to a Linux-based environment is more than just a technical upgrade for those who are concerned about security; it is a proactive attempt to protect their digital sovereignty. By adopting Linux, users are not simply changing their operating system; they are committing to a privacy-first paradigm, where the core objective is to maintain a high level of user autonomy, integrity, and trust throughout the entire process.

Read more »
X
Apple lazarus Linkedin macOS malware Microsoft X

Lazarus Gang Targets Job Seekers to Install Malware

Lazarus Gang Targets Job Seekers to Install Malware

North Korean hackers responsible for Contagious Interview are trapping job seekers in the cryptocurrency sector by using the popular ClickFix social-engineering attack strategy. They aimed to deploy a Go-based backdoor— earlier undocumented— known as GolangGhost on Windows and macOS systems. 

Hackers lure job seekers

The latest attack, potentially a part of a larger campaign, goes by the codename ClickFake Interview, according to French cybersecurity company Sekoia. Aka DeceptiveDeployment, DEV#POPPER, and Famoys Chollima; Contagious Interview has been active since December 2022, however, it was publicly reported only after late 2023. 

The attack uses legitimate job interview sites to promote the ClickFix tactic and deploy Windows and MacOS backdoors, said Sekoia experts Amaury G., Coline Chavane, and Felix Aimé, attributing the attack to the notorious Lazarus Group. 

Lazarus involved

One major highlight of the campaign is that it mainly attacks centralized finance businesses by mimicking firms like Kraken, Circle BlockFi, Coinbase, KuCoin, Robinhood, Tether, and Bybit. Traditionally, Lazarus targeted decentralized finance (DeFi) entities. 

Attack tactic explained

Like Operation Dream Job, Contagious Interview also uses fake job offers as traps to lure potential victims and trick them into downloading malware to steal sensitive data and cryptocurrency. The victims are approached via LinkedIn or X to schedule a video interview and asked to download malware-laced video conference software that triggers the infection process. 

Finding of Lazarus ClickFix attack

Security expert Tayloar Monahan first reported the Lazarus Group’s use of ClickFix in late 2022, saying the attack chains led to the installment of a malware strain called FERRET that delivered the Golang backdoor. In this malware campaign, the victims are prompted to use a video interview, ‘Willow,’ and do a sell video assessment. 

The whole process is carefully built to gain users and “proceeds smoothly until the user is asked to enable their camera,” Sekoia said. At this stage, an “error message appears, indicating that the user needs to download a driver to fix the issue. This is where the operator employs the ClickFix technique," adds Sekoia. 

Different attack tactics for Windows and MacOS users

The prompts given to victims may vary depending on the OS. For Windows, victims are asked to open the Command Prompt and run a curl command to perform a Visual Basic Script (VBS) file to launch a basic script to run GolanGhost. MacOS victims are prompted to open the Terminal app and perform a curl command to run a malicious shell script, which then runs another shell script that runs a stealer module called FROSTYFERRET—aka ChromwUpdateAlert— and the backdoor. 

Read more »
XCSSET
macOS malware Microsoft Xcode Program XCSSET

Microsoft Unearths Novel XCSSET macOS Malware Variant Targeting Xcode Projects

 

Microsoft Threat Intelligence identified a new strain of XCSSET, a complex modular macOS malware that targets Xcode programs. The malware was discovered in the wild during routine threat hunting, and it is the first known XCSSET variant to appear since 2022. 

This latest version of XCSSET includes improved obfuscation methods, updated tactics for maintaining persistence on infected workstations, and new ways to infect systems. These enhancements enable the malware to steal and exfiltrate files, as well as sensitive system and user information, such as digital wallet data and private notes.

XCSSET is meant to infect Xcode projects and runs when a developer builds them. Since Xcode is frequently used by Apple and macOS developers, Microsoft believes the malware spreads by exploiting shared project files amongst developers. While this edition has some similarities with previous versions, it features a more modular structure and encoded payloads. 

Harder to detect and eliminate 

In order to evade detection by security, it also has improved error handling and makes extensive use of scripting languages, UNIX commands, and genuine system binaries. It can sometimes even function without leaving files on disc, which makes them more challenging to locate and delete. To make it harder for analysts to comprehend its operations, the malware conceals the names of its modules at the code level. 

Additionally, it employs more sophisticated obfuscation techniques, like randomly generating and encoding payloads when infecting Xcode projects. The most recent version of XCSSET also employs Base64 for encoding, in contrast to previous versions that solely used xxd (hexdump). 

To ensure that it continues to run, the malware exploits three separate persistence methods: it runs when a new shell session is started, when a user opens a fake Launchpad program, or when a user makes a Git commit. It also includes a new method for injecting malware payloads directly into targeted Xcode projects. 

Microsoft's analysis also revealed that some of the malware appears to be still in development. Its command-and-control (C2) server was operational at the time Microsoft released its report, and it was releasing new modules. Microsoft recommends developers and security teams to remain careful and keep an eye on their Xcode projects and environments for any unusual activity. 

Surge in macOS assaults 

The latest ransomware is just one example of the sophisticated attacks that have increased against macOS systems, according to Thomas Richards, Principal Consultant, Network and Red Team Practice Director at Black Duck. 

“The techniques seen in this malware show that the developers spent a considerable amount of time researching ways to remain undetected. Gone are the days where macOS users could operate without installing anti-virus or EDR software. To prevent these attacks from spreading, users of Xcode should make sure their endpoint protection software is up to date and run scans to determine if they’ve been infected or not,” Richards stated. 

Threat to Apple developers 

With its improved ability to conceal within Xcode projects and propagate when these projects are shared between teams, this new XCSSET variant poses a serious threat to Apple developers, stated J Stephen Kowski, Field CTO at SlashNext. 

“This sophisticated attack targets the software supply chain at its source, potentially compromising apps before they’re even built, with the malware’s improved obfuscation techniques and multiple persistence methods making it particularly difficult to detect. Real-time code scanning and advanced threat detection tools that can identify suspicious behaviors in development environments are essential for protecting against these types of attacks,” Kowski noted.

He recommends developers to use multi-layered security measures, such as constant monitoring of project files for unexpected changes and rigorous verification of all code sources prior to integration.
Read more »
Technology
CyberCrime Cyberhackers Cybersecurity CyberThreat Koi Stealer macOS RustDoor Software Target Crypto Technology

North Korea-Linked Hackers Target Crypto with RustDoor and Koi Stealer

 


A significant amount of malware has become a common threat to Mac OS systems in today’s rapidly developing threat landscape. The majority of these threats are associated with cybercriminal activities, including the theft of data and the mining of cryptocurrencies without consent. As of recently, cybercrime operations have been attributed to groups of advanced persistent threat (APT) groups that are sponsored by the North Korean government. 

In addition to this trend, the Federal Bureau of Investigation (FBI) recently issued a public service announcement regarding North Korean social engineering campaigns. In many of these attacks, deceptive tactics are used to manipulate victims into divulging sensitive information or allowing access to the system. This type of attack is usually carried out using deceptive tactics. As such, there have been increasing numbers of such incidents targeting software developers within the cryptocurrency industry, specifically those seeking employment opportunities, in a growing number of such incidents. 

In my view, these sophisticated cyber threats, originating from North Korean threat actors, demonstrate the persistence and evolution of these threats. Known as CL-STA-240, or Contagious Interview, the cyber campaign aims to infiltrate macOS systems with advanced malware strains, including RustDoor and Koi Stealer. It is known that these malicious programs have been specifically designed to exfiltrate sensitive data and can use sophisticated techniques to avoid detection within the macOS environment while doing so. As a result of this campaign's technical proficiency, it reinforces the fact that threats targeting the Apple ecosystem are becoming increasingly complex as time passes. 

he threat actors responsible for this operation are utilizing social engineering as a primary attack vector. By impersonating recruiters or potential employers, they can trick job seekers, especially those working in the cryptocurrency industry, into installing the compromised software unintentionally. It is through this deceptive strategy that attackers can gain access to critical data while maintaining operational stealth. 

These manipulative strategies are becoming increasingly popular, highlighting the persistent threat that state-sponsored cybercriminal groups, especially those linked to North Korea, continue to pose as they continue to refine their methods to exploit human vulnerability to continue their operation. In the course of this cyber campaign, researchers have revealed that Rust-based malware, referred to as RustDoor, is hiding inside legitimate software updates to evade detection. In addition, researchers have discovered that there was an undocumented macOS variant of the Koi Stealer malware that has been discovered for the first time in recent years. 


A recent investigation uncovered rare techniques for evasion, including manipulating macOS system components to conceal their presence and remain undetected. These sophisticated tactics underscore the increasing sophistication of threats aimed at Mac OS. In the past year, several reports have linked North Korean threat actors to cyberattacks targeting job seekers, which are based on the characteristics and methodologies observed in this campaign. 

According to the available evidence, analysts can rely on a moderate degree of confidence that this attack was carried out to further North Korean state-sponsored cyber objectives. By using social engineering to target job seekers, these adversaries are further proving that they are involved in an extensive pattern of attacks. An in-depth technical analysis of the recently identified Koi Stealer macOS variant was performed in this research, which provides an in-depth picture of the attackers’ activities in compromised environments. 

In addition, Cortex XDR is used to examine the various stages of the attack to provide an understanding of the investigation. A suite of advanced security solutions offered by Palo Alto Networks, an established leader in network security solutions, helps Palo Alto Networks' customers protect themselves from these evolving threats, including applications such as: Two products offer enhanced detection and responding capabilities - Cortex XDR and XSIAM. Computer-based security services for firewalls, such as Advanced WildFire, Advanced DNS Security, and Advanced URL Filtering that provide proactive defense against malicious activities. 

The use of these security solutions can help organizations greatly strengthen their defenses against RustDoor, Koi Stealer, and similar malware threats targeting MacOS environments. Often, victims are tricked into downloading malware disguised as legitimate software development tools in the form of fake job interviews associated with this campaign, which results in the infection process starting with a fake job interview. The attackers were particularly noteworthy for using malicious Visual Studio projects, which is a strategy previously documented in similar cyber campaigns analyzed by Jamf Threat Labs. 

When the RustDoor malware is executed, it establishes persistence within the system and attempts to exfiltrate sensitive user information, which is one of the first steps toward completing its operations. Researchers have discovered that the threat actors have attempted to execute several variants of the malware throughout the investigation. As a result of this adaptive behavior, it appears to me that attackers are continuously adapting their approach in response to security controls and detection mechanisms in place.

According to security researchers, when the Cortex XDR was blocked for the initial attempt at infiltration, adversaries quickly tried to re-deploy and execute additional malware payloads to circumvent detection by redeploying and executing additional malware payloads. RustDoor Infection Stages An infection process that involves two RustDoor binaries being executed in hidden system directories to avoid detection of the malware is the process by which the RustDoor malware operates. 

Another stage involves the deployment of additional payloads, such as a reverse shell, that allows attackers to gain remote access. Several sensitive data sets were stolen, and the attackers specifically targeted credentials stored in web browsers, such as LastPass data from Google Chrome, as well as exfiltrating the information into command and control servers under their control. As part of this campaign, it was discovered that an IP address known as 31.41.244[.]92 has previously been used to conduct cybercriminal activities. This was one of our most significant findings. 

The threat has also been associated with the RedLine Stealer infostealer campaign, which further reinforces the sophisticated nature of the ongoing threats that have been identified. The second malware strain identified, Koi Stealer, possesses advanced data exfiltration capabilities, as compared to the previously undocumented macOS variant. According to this discovery, it is clear that macOS-targeted malware continues to evolve and that robust cybersecurity measures are necessary to mitigate the risks posed by these sophisticated threats and help to minimize incidents. 


As a result of the Koi Stealer malware, a run-time string decryption mechanism is utilized by it. Throughout the binary code, there is a single function that is repeatedly invoked. In the decryption function, each character of a hard-coded key (xRdEh3f6g1qxTxsCfg1d30W66JuUgQvVti) is iterated sequentially from index 0 to index 33 and the XOR operation is applied between the key’s characters and the encrypted string's characters, in a way that is applied sequentially. 

To get a better understanding of how Koi Stealer behaves, researchers developed a custom decryption program that replicates the malware's logic to gain insight into the malware's behavior, along with the techniques it uses to disguise its true functionality. Using the same decryption routine, analysts were able to extract and analyze the decrypted strings with success, allowing a more comprehensive understanding of the malware’s capabilities and objectives. There are significant similarities between the code structure and execution flow of different versions of Koi Stealer, as shown by a comparison between the various variants. 

Each variant of malware was designed consistently to steal data. Each category of stolen information was contained within separate functions within each variant. This modular design indicates that the malware has been developed in a structured and organized manner, further proving its sophistication. Besides targeting common types of information stealers, Koi Stealer also has a specific interest in specific directories and configurations that are not commonly found in the information stealer world. 

Interestingly, both of the analyzed samples actively target user data from Steam and Discord, which indicates a deep interest in credentials related to gaming platforms and communication platforms. A wide range of targeted data demonstrates how versatile the malware is and how it is capable of being exploited for a wider range of purposes than traditional financial or credential thefts. The detailed breakdown of the notable decrypted strings and the additional technical findings found in Appendix C provides further insight into Koi Stealer's internal operations and goals, as well as providing additional insight into the company's internal operations.
Read more »
User Security
Banshee Stealer Infostealer macOS malware User Security

New Version of Banshee Malware Targets macOS Users

 

According to the latest study published this week, a new variant of the info-stealing malware known as "Banshee" has been targeting macOS users' passwords, cryptocurrency wallets, browser credentials, and other data for at least the past four months.

Check Point researchers discovered that the latest version targets anyone using a Mac and can be downloaded mostly through malicious GitHub uploads, but also through other websites (GitHub's policies prohibit malware, but this does not mean there is no malware on GitHub). 

This latest Banshee malware often disguises itself as the Telegram messaging app or the Google Chrome browser, two popular apps that other malware attackers use to trick users. This version first surfaced in September last year and attempts to evade detection by using Apple's proprietary string encryption algorithm, XProtect.

This malware targets your browsing activities in Chrome, Brave, Edge, or Vivaldi. It also attempts to steal your cryptocurrency if you have any crypto wallet browser extensions installed, and it may show macOS victims fake login pages in an attempt to steal their usernames and passwords, which it then uses to steal accounts and funds. It will target your Coinbase, Ronin, Slope, TONNE, MetaMask, and other cryptocurrency wallet extensions if you have them. 

The source code for Banshee was leaked online in November. This could have helped antivirus companies ensure their software catches the sneakier version in the months since. Prior versions of this malware were marketed as "stealer-as-a-service" malware on cybercriminal channels, including attacker-controlled Telegram channels, for $3,000 per "license.” 

To stay protected from info-stealer malware, it's a good idea to consider getting a crypto hardware wallet like one from Ledger or Trezor if you have over $1,000 in crypto. In general, it's also a good practice to avoid storing more than $1,000 in any browser extension-based crypto wallet (you can also store funds with an exchange like Coinbase, Robinhood, or Kraken). 

Additionally, passwords should never be kept in an unsecured digital document on your computer (no Google Docs). Instead, think about keeping your crypto seed phrases on paper in a closed box or safe at home.
Read more »
Technology
KASLR Kernel Security macOS SysBumps Technology

SysBumps: A Groundbreaking KASLR Break Attack Targeting Apple Silicon macOS Devices

SysBumps: Attack Disurpts KASLR in MacOS Kernel Security

In a significant revelation, researchers from Korea University have uncovered “SysBumps,” the first successful Kernel Address Space Layout Randomization (KASLR) break attack targeting macOS devices powered by Apple Silicon processors. Presented at CCS '24, the study exposes flaws in speculative execution that compromise critical kernel memory addresses, presenting severe security implications for macOS users.

Kernel Address Space Layout Randomization (KASLR) is a vital security mechanism designed to randomize memory locations, thereby mitigating memory corruption vulnerabilities. Apple has enhanced KASLR on macOS for Apple Silicon devices with features like kernel isolation, which separates kernel and user memory spaces to bolster system security.

However, the study identifies a critical weakness in this implementation. Researchers discovered that speculative execution during system calls introduces a vulnerability. This flaw enables attackers to bypass kernel isolation and infer kernel memory locations, undermining the effectiveness of KASLR.

Mechanics of the SysBumps Attack

SysBumps exploits speculative execution vulnerabilities by manipulating system calls to avoid kernel address validation checks. This triggers the Translation Lookaside Buffer (TLB) to behave differently depending on the validity of the address being probed. By leveraging TLB as a side-channel, attackers can gather insights into kernel memory layouts.

The attack unfolds in three stages:

  1. Speculative Execution: Attackers craft system calls to bypass validation mechanisms, exploiting speculative execution to access kernel address translations.
  2. TLB Probing: By analyzing TLB state changes, attackers determine whether specific kernel addresses are valid.
  3. Revealing Kernel Layout: Using reverse-engineered TLB attributes, attackers deduce the kernel base addresses, effectively breaking KASLR protections.

Remarkably, this attack achieves a 96.28% success rate across various M-series processors and macOS versions. It executes in under three seconds, demonstrating its efficiency and potential for real-world exploitation.

Implications and Response

The SysBumps attack has far-reaching consequences for macOS security. By breaking KASLR, the primary defense against memory corruption exploits, this attack leaves systems vulnerable to advanced threats. Despite Apple’s kernel isolation mechanisms, SysBumps exposes the underlying architecture to significant risks.

Apple has acknowledged the findings and is actively investigating the root cause of the vulnerability. The researchers plan to publish their study and the SysBumps source code on GitHub, offering valuable insights for the cybersecurity community to address future challenges.

The discovery of SysBumps highlights the evolving sophistication of cyberattacks, particularly those exploiting speculative execution and architectural flaws. This serves as a critical reminder of the need for ongoing research, robust system design, and proactive security measures to safeguard against emerging threats in the cybersecurity landscape.

Read more »
Ransomwares
Cyber Security Cyber Security Vendor macOS MacOS Malware Malware attacks MITRE MITRE ATT&CK Ransomwares

MITRE’s Latest ATT&CK Evaluations Reveal Critical Insights into Cybersecurity Solutions

 

MITRE Corporation has published its findings from the latest round of ATT&CK evaluations, offering important insights into the effectiveness of enterprise cybersecurity solutions. This sixth evaluation assessed 19 vendors against two major ransomware strains, Cl0p and LockBit, as well as North Korean-linked malware targeting macOS systems. The advanced malware simulations used during the evaluation highlighted sophisticated tactics, such as exploiting macOS utilities and covert data exfiltration, emphasizing the dynamic nature of modern cyber threats.

The Findings and Their Significance

According to MITRE’s general manager, William Booth, the evaluation revealed notable disparities in vendors’ abilities to detect and distinguish between malicious activities. Some solutions achieved high detection rates but also suffered from alarmingly high false-positive rates, indicating a need for better precision in threat identification. MITRE’s methodology involved a two-phase approach: first, evaluating baseline detection capabilities and then assessing protection performance after vendors adjusted their configurations to improve detection accuracy. This approach highlights the adaptability of vendors in enhancing their solutions to counter emerging threats.

The Struggles with Post-Compromise Detection

A key takeaway from the evaluation was the struggle vendors faced with post-compromise threat detection. MITRE stressed the importance of detecting and mitigating ransomware activities after the initial breach, as ransomware often mimics legitimate system behaviors. Booth emphasized that relying solely on blocking initial infections is no longer sufficient—solutions must also account for activities occurring later in the attack chain. This represents a critical area where cybersecurity solutions need improvement to effectively neutralize threats at all stages of an attack.

Contrasting Detection Strategies

The evaluation also highlighted differences in detection strategies among vendors. Some vendors utilized machine learning and AI-based methods for threat detection, while others relied on more traditional heuristic approaches. These contrasting methodologies led to varying levels of effectiveness, particularly in the detection of false positives and distinguishing between benign and malicious activities. The use of AI-based methods showed promise, but some vendors struggled with accuracy, underscoring the challenges faced by the industry in keeping up with evolving threats.

MacOS Threats: A New Challenge

For the first time, MITRE included macOS threats in its evaluation. Addressing macOS malware posed unique challenges, as there is limited publicly available Cyber Threat Intelligence (CTI) on such threats. Despite these challenges, MITRE’s inclusion of macOS malware reflects its commitment to addressing the evolving threat landscape, particularly as more organizations adopt Apple devices in their enterprise environments. The move signals MITRE’s proactive approach to ensuring that cybersecurity solutions account for all major operating systems in use today.

Looking Ahead: Vendor Transparency and Improvement

Although MITRE refrains from ranking vendors, its evaluation provides transparency that can guide organizations in making informed decisions about their cybersecurity strategies. The findings underscore the importance of refining cybersecurity technologies to meet the demands of a rapidly evolving cyber environment. Booth highlighted that these evaluations encourage vendors to continuously improve their technologies to better counter the increasing sophistication of cyber threats.

By incorporating ransomware and macOS malware into its evaluations, MITRE continues to shed light on the complexities of modern cyberattacks. The insights gained from this evaluation are invaluable for organizations looking to enhance their defenses against increasingly sophisticated threats. As cyberattacks become more advanced, understanding the varying capabilities of enterprise security solutions is essential for building a robust cybersecurity posture.

Read more »
Windows
Check Point research CyberCrime Cyberhackers Cybersecurity Cyberthreats GodLoader Godot Game iOS Linux macOS malware Windows

Godot Game Engine Targeted in Widespread Malware Attack

 


A newly identified malware threat, GodLoader, is targeting gamers globally by exploiting the Godot game development engine, according to a report from Check Point Research. This sophisticated attack has already impacted more than 1.2 million users across various platforms. 

How GodLoader Works 

 
GodLoader infiltrates devices by leveraging Godot’s .pck files, which package game assets. These files can embed harmful scripts that execute malicious code upon launching a game, effectively bypassing traditional antivirus detection. The malware primarily targets: 

-Windows 
- macOS 
- Linux 
- Android 
- iOS 

Check Point Research reported that hackers have infected over 17,000 systems in just the past three months. By utilizing Godot’s GDScript (a Python-like scripting language), attackers distribute malware via more than 200 GitHub repositories, often masked as legitimate game assets. 

Exploitation of Open-Source Trust 


Eli Smadja, Security Research Group Manager at Check Point Software Technologies, highlighted the exploitation of open-source platforms:  

"Cybercriminals have turned the flexibility of the Godot Engine into a vulnerability, spreading cross-platform malware like GodLoader by capitalizing on the trust users place in open-source software." 

Infected computers are not only compromised but may also be converted into cryptocurrency mining rigs through XMRig, rendering them unusable for other tasks. 

Stargazers Ghost Network: Distribution-as-a-Service (DaaS) 


The attackers used the Stargazers Ghost Network to distribute GodLoader. This platform, active since 2022, employs over 3,000 ghost GitHub accounts to create networks of malicious repositories. These repositories: 

- Host info stealers like RedLine, Lumma Stealer, Rhadamanthys, and RisePro. 
- Manipulate GitHub’s trending section by starring, forking, and subscribing to their own repositories to appear legitimate. 

During a campaign between September and October 2024, Check Point discovered four separate attacks targeting developers and gamers. These attacks aimed to distribute infected tools and games, enticing users to download malware through seemingly credible GitHub repositories. 

Broader Implications and Future Risks 


The malware’s ability to target multiple platforms significantly enlarges the attack surface, posing a growing threat to the gaming community. Experts warn that attackers could embed malware into cheats, mods, or cracks for popular Godot-built games, increasing the vulnerability of millions of gamers. 

The Stargazers Ghost Network has already earned over $100,000 by distributing malware through its DaaS platform. With its continuous evolution, this network poses an ongoing threat to both developers and users of the Godot engine. 

Call to Action for Developers and Gamers 


Industry experts emphasize the urgent need for proactive cybersecurity measures to counter such threats. Recommendations include: 

- Avoid downloading game assets from unverified sources. 
- Regularly update antivirus and anti-malware software. 
- Implement robust security practices when developing or downloading games built with Godot. 

As the gaming ecosystem continues to expand, vigilance and collaboration between developers and security researchers will be critical in mitigating threats like GodLoader and ensuring a safer gaming environment.
Read more »
Threat Landscape
BlueNoroff macOS malware North Korea Hackers Threat Landscape

North Korean Hackers Employ macOS Malware to Target Crypto Firms

 

BlueNoroff, a North Korean threat actor, has been attacking crypto firms with a new multistage malware for macOS systems. 

According to the researchers, the campaign is known as Hidden Risk, and it lures victims with emails that include fake data on the current activities in the cryptocurrency market.

The malware employed in these attacks depends on a novel persistence method on macOS that does not generate any alerts on the most recent versions of the operating system, allowing it to bypass detection. 

BlueNoroff is known for cryptocurrency theft and has previously targeted macOS with a payload malware called 'ObjCShellz' that opens remote shells on affected Macs. 

Infection chain 

The attacks begin with a phishing email containing crypto-related news and subjects, disguised as if forwarded by a bitcoin influencer to boost credibility. The mail includes a link to a PDF containing the information, but it actually points to the attackers' "delphidigital[.]org" domain. 

According to SentinelLabs experts, the "URL currently serves a benign form of the Bitcoin ETF document with titles that change over time," but it also serves the first step of a malicious application bundle known as 'Hidden Risk Behind New Surge of Bitcoin Price.app'. 

The researchers state that for the Hidden Risk campaign, the threat actor employed an original academic paper from the University of Texas. The first stage is a dropper software signed and notarised with a valid Apple Developer ID, "Avantis Regtech Private Limited (2S8XHJ7948)," which Apple has since revoked. 

When activated, the dropper gets a decoy PDF from a Google Drive link and opens it in the default PDF browser to distract the victim. In the background, however, the following stage payload is downloaded from "matuaner[.]com.”

Interestingly, the hackers have effectively circumvented Apple's App Transport Security standards by altering the app's 'Info. plist' file to permit unsafe HTTP connections to the attacker-controlled site. 

The "Hidden Risk" campaign, according to SentinelLabs, has been in operation for the past 12 months or more. It employs a more straightforward phishing strategy that excludes the customary "grooming" on social media that other DPRK hackers partake in. 

In order to get beyond macOS Gatekeeper, the researchers also point out that BlueNoroff has demonstrated a consistent capacity to find new Apple developer accounts and have their payloads notarised.
Read more »
Vulnerabilities
CyberCrime Cybersecurity CyberThreat HM Surf macOS Microsoft Privacy Safari Vulnerabilities

HM Surf Bug in macOS Raises Data Privacy Concerns

 


Several vulnerabilities in the Safari web browser for macOS may have left users open to being spied on, having their data stolen, and acquiring other types of malware thanks to this security weakness. Specifically, the vulnerability arises from the special permissions Apple gives to its proprietary apps, and here, it is the browser, as well as the ease with which an attacker can obtain the important configuration files of an app. 

Ultimately, what it allows a user to do is to circumvent the Transparency, Consent, and Control (TCC) security layer on MacBooks that is designed to safeguard sensitive data from an attacker. CVE-2024-44133 has been rated as a "medium" severity vulnerability by the Common Vulnerability Scoring System (CVSS), meaning that it has a 5.5 severity score as per the CVSS. According to the CVE-2024-44133 vulnerability report, attackers can bypass the user data protection methods implemented by the operating system by bypassing Transparency, Consent, and Control (TCC). 

During the September 16 update for Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later), the vulnerability, also referred to as CVE-2024-44133, had been fixed. Please take note that this vulnerability will only impact devices that are managed by Mobile Device Management (MDM), not any other device. Typically, MDM managed devices are subject to policies and procedures set by the IT department of an organization, which is responsible for centrally managing and maintaining the devices.


According to Microsoft, the flaw has been named "HM Surf." By exploiting this vulnerability an attacker would be able to bypass macOS' Transparency, Consent, and Control (TCC) features and gain unauthorized access to a user's protected data, which they would have no control over. There is a possibility users may discover Safari's TCC in action while browsing a website that requires access to the camera or microphone when browsing through the website. It was noted by Apple in mid-September that a bug in macOS Sequoia 15 has been fixed by removing the vulnerable code. However, the bug does not seem to affect MDM-managed devices. As stated in the blog post, Microsoft’s Sequoia 15 release only protects Apple’s Safari web browser when it is installed. 

It was also pointed out that browsers like Google Chrome and Mozilla Firefox don't have the same private entitlements as Apple applications, so they cannot bypass TCC checks like Apple applications can. Therefore, once TCC checks are approved, it is up to the app to maintain access to the privacy database as long as people have approved the checks. This vulnerability can be exploited by removing the TCC protection for the Safari browser directory and editing a configuration file in that directory. It is stated in Microsoft's response that it involves gaining access to the user's data, such as browsed pages, the camera, microphone, and location of the device, without the user's knowledge.

Users of macOS are strongly encouraged to apply these security updates as soon as possible so that their system will be protected. Using its behavior monitoring capabilities, Microsoft Defender for Endpoint has detected activities associated with Adload, one of the most prevalent macOS threat families, which may be exploiting this vulnerability in some way. In addition to detecting and blocking CVE-2024-44133 exploitation, Windows Defender for Endpoint also detects and blocks anomalous modifications of the Preferences file through HM Surf or other mechanisms that potentially exploit the vulnerability.

According to Microsoft, it was TCC technology that first enabled them to learn how to bypass the technology when they discovered powerdir's vulnerability. Please remember that TCC, as its name implies, is a technology that prevents apps from accessing users' personal information when they are installed and that this includes services such as location services, camera and microphone devices, download directories, and others, without the user's knowledge or consent. 

In the world of mobile applications, the only legal way for them to gain access to these services is by approving a popup through their user interface, or if they approve per-app access via the settings in their operating system. This vulnerability, known as HM-Surf, may allow attackers to bypass key security features on macOS systems, which gives them a chance to gain access to sensitive data through the use of malicious code. It is possible that users who are not authorized to exploit the flaw could exploit macOS' own security functions, such as the sandboxing mechanisms and restrictions on file access. 

HM-Surf exploit is a vulnerability that allows attackers to gain enhanced privileges, which allows them to access sensitive data and files that would otherwise require a login and password. Initial warnings were raised about this vulnerability because it played a role in adware campaigns, where malicious actors used this loophole to install unwanted software on users' devices in order to profit from the vulnerability. There are, however, a lot more dangers than just adware; though, it is only the beginning. If the same vulnerability were weaponized, then it might even be used for more serious attacks, such as data exfiltration, surveillance, or even as a gateway to further malware infiltration in the near future. There is probably no doubt that HM-Surf's unique ability to bypass Apple's robust security architecture is one of the most troubling aspects of this malware. 

Security macOS is widely regarded as a secure platform, but the recent discovery of the HM-Surf vulnerability shows that even advanced systems are not immune to evolving cyber threats. This finding serves as a crucial reminder for users and organizations to prioritize cybersecurity and adopt proactive measures to protect their digital environments. Microsoft's cybersecurity team uncovered HM-Surf, an exploit posing a serious risk to macOS. Their investigation revealed a program altering Google Chrome settings to grant unauthorized microphone and camera access while collecting user and device data. 

These actions suggested preparations for a second-stage payload that could further compromise the device. The culprit was identified as the well-known macOS adware "AdLoad." This malware hijacks browser traffic, inundates users with ads, harvests data, and transforms infected devices into botnet nodes for further malicious activity. Although Microsoft's findings aligned with HM-Surf techniques, the researchers could not conclusively link AdLoad to actively exploiting the vulnerability. 

Nevertheless, they warned that "attackers using a similar method to deploy a prevalent threat" underscored the need for enhanced protection. The HM-Surf vulnerability illustrates the risks associated with macOS, highlighting that no operating system is invulnerable to sophisticated attacks. Exploiting such weaknesses could lead to severe consequences, including financial losses, reputational damage, and the exposure of sensitive data. The evolving nature of these threats suggests that attackers are continuously refining their methods to bypass security measures.

To address these challenges, organizations must adopt a multi-layered approach to cybersecurity. This includes regular system updates, comprehensive monitoring, and user education on safe practices. Deploying advanced threat detection and real-time monitoring can help detect and mitigate attacks before they cause significant harm. Regular security assessments can also identify and address potential vulnerabilities. In summary, the emergence of the HM-Surf vulnerability is a stark reminder of the dynamic landscape of cybersecurity threats. For macOS users and businesses, this discovery emphasizes the need to act swiftly in strengthening defenses and protecting digital assets against evolving risks.
Read more »
Subscribe to: Posts (Atom)