Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label macOS Security. Show all posts
macOS Security
Apple Critical Vulnerability cryptocurrency cryptocurrency mining CVSS Cyber Security iOS macOS flaw macOS macOS Security

Apple macOS Flaw Exploited in the Wild to Install Monero Cryptominers

 

A critical vulnerability in the recently updated Apple macOS has been weaponized by threat actors to mine Monero cryptocurrency, according to the Netherlands National Cyber Security Centre (NCSC-NL). The security flaw under identifier CVE-2026-65400 with a CVSS score of 9.8/10 impacts the macOS Screen Sharing component and is described as allowing ‘remote code execution via crafted network packets’. Apple released emergency security updates for macOS Tahoe 26.6.1, macOS Sequoia 15.7.9 and macOS Sonoma 14.8.9 this month to address the flaw. 

The tech giant explained the changes were related to an authentication issue, ‘fixing state management to ensure credentials are properly validated.’ The vulnerability was discovered by security researcher Alfredo Pesoli of Bynario. According to the NCSC-NL, there are currently reports of bad actors actively using this exploit. ‘Multiple systems with port 5900 open to the internet,’ the Netherlands-based watchdog stated in a report this week, ‘were compromised using this vulnerability.’ 

In all cases of exploitation detected so far, the attackers gained root access to the targeted systems and deployed a Monero cryptocurrency miner. It remains unclear how long the threat landscape had been targeting macOS Screen Sharing, how many systems had been impacted, and whether the mining activity was the sole motive behind the attacks. Several other flaws impacting the macOS Screen Sharing component have also been detected. 

They include CVE-2026-43760 which can lead to the disclosure of sensitive information, arbitrary file creation, and remote code execution under specific conditions; CVE-2026-43777, which may result in a denial-of-service scenario; and CVE-2026-43779 with a logic flaw that can cause applications to hijack connections from other processes. According to Pesoli’s research, there are additional privilege escalation possibilities in an older authentication method used by Screen Sharing, including VNC passwords. 

A threat actor with the VNC password could potentially access protected files or create new files with root permissions, resulting in remote code execution. The researcher also highlighted a pre-authentication vulnerability in the Screen Sharing daemon which, if successfully exploited, would allow an attacker to compromise a Mac with Screen Sharing enabled and without requiring a VNC password. ‘All the attacker needed was a target IP address,’ he added. 

His findings suggest that tens of thousands of Screen Sharing services were exposed to the internet, putting residential users, educational institutions, and corporations at risk. Researchers advise that Screen Sharing should not be exposed to the internet and recommend that such services be placed behind an IPsec or other secure access gateway. It is unclear how many macOS users had their systems compromised via the Screen Sharing flaw. 

However, cybersecurity analysts warn that AI-powered tools are facilitating faster threat modeling and detection, enabling attackers to exploit vulnerabilities almost immediately after they become publicly known. ‘We had an AI agent that helped us develop working exploits for two of the Screen Sharing vulnerabilities within hours of their disclosure,’ Calif, a security company, noted in a report. macOS users must install the latest software updates released by Apple to ensure their systems are protected against the newly discovered flaws. 

Customers who cannot immediately install the critical security patches should disable Screen Sharing in their Mac’s Sharing preferences until the updates are deployed.
Read more »
malware
Apple Crash Reporter Apple malware CrashStealer MacOS Malware macOS Security malware

CrashStealer Malware Targets macOS Users by Posing as Apple Crash Reporter

 

A newly identified malware strain named CrashStealer is targeting macOS users by disguising itself as Apple's legitimate crash reporting utility. Designed as a C++-based infostealer, the malware is capable of stealing sensitive information, including login credentials, Keychain data, browser passwords, and cryptocurrency wallet information.

According to a research advisory published by Jamf on July 13, CrashStealer first came to light after researchers identified a suspicious sample uploaded to VirusTotal. The researchers believe the malware was under development since May before being deployed in active attacks.

CrashStealer mimics Apple's authentic crash reporting feature, which typically appears after an application crashes unexpectedly. The malware disguises itself using filenames such as CrashReporter.dmg for installation and CrashReporter.app for the application, along with an icon resembling Apple's legitimate software.

One of its notable tactics is displaying a fake macOS authorization prompt to trick users into entering their system password. Once entered, the malware verifies the credentials locally before attempting to extract information from browsers, password managers, Keychain, and cryptocurrency wallets. The stolen information is then encrypted and transmitted to an attacker-controlled server.

Signed Installer Helps Malware Evade Detection

The malware is distributed through a disk image packaged as "Werkbit Setup," which contains the malicious CrashReporter installer. Unlike many traditional malware campaigns, the installer carries a valid Apple Developer ID and notarization, allowing it to bypass Apple's Gatekeeper security checks during the initial launch.

The Jamf researchers said, "Because the dropper carries a valid Developer ID and a stapled notarization ticket, it clears Gatekeeper on first launch, in contrast to the ad-hoc-signed payload it installs."

As a result, the installer appears legitimate and may not immediately raise suspicion among users.

Researchers also highlighted other attack techniques increasingly targeting macOS users. One such method is ClickFix, a social engineering technique that convinces users to manually execute malicious commands by presenting fake troubleshooting instructions or CAPTCHA verification prompts.

Artificial intelligence is also emerging as a new distribution channel. Security researchers have observed malware such as Atomic macOS Stealer being spread through manipulated AI chatbot conversations that redirect users to malicious websites hosting malware payloads.

Security Experts Recommend Safe Download Practices

Cybersecurity experts note that macOS is no longer immune to malware threats, with attackers continuing to adopt more sophisticated techniques. The growing use of artificial intelligence in cybercrime is expected to further accelerate the evolution of these attacks.

To reduce the risk of infection, users are advised to download applications only from trusted sources, carefully verify unexpected password prompts, and regularly install macOS and application updates to benefit from the latest security patches.
Read more »
Terminal Command Scam
ClickLock Malware ClickLock Stealer Cryptocurrency Wallet Theft Cyber Threats information stealer MacOS Malware macOS Security Social Engineering Attack Terminal Command Scam

Group-IB Uncovers ClickLock macOS Malware Targeting Passwords and Crypto Wallets


An aggressive social engineering technique has been used by ClickLock, an information-stealing macOS malware, to obtain victims' information about their system login passwords. Security researchers at Group-IB report that the malware disables normal system functionality, leaving users with little interaction other than a password prompt designed to harvest their credentials. 


After a malicious shell script was uploaded to VirusTotal in June, ClickLock was discovered to have already compromised 100 computer systems in 33 countries since May after first being identified in June. According to researchers, ClickLock is still undergoing active development and remained undetected by security engines on the platform when it was discovered, showing its ability to evade traditional antivirus solutions. 

Despite analyzing the full payload chain of the malware, the initial lure pages used to deliver the attack have not yet been identified, suggesting that the campaign's distribution infrastructure is still evolving. Despite the complete analysis of the malware chain, investigators have not yet identified the original lure pages that were used to deliver the attack. Group-IB researchers also believe ClickLock is still under active development. 

The compromised websites hosting the malicious payloads have been identified, but the exact methods used to drive victims to those pages remain under investigation. Over half of the known victims are located in Europe, according to Group-IB. Despite the fact that it is unclear how precisely the malware is distributed, researchers believe that it has been active since late May. 

According to experts, the attackers use SEO poisoning, compromised websites, or social media posts to lure users to fake verification pages that send them to malicious websites.

How the Attack Works

According to experts, the infection is believed to have originated through a social engineering campaign similar to ClickFix, in which victims are fooled into copying and pasting a malicious command into the macOS Terminal, pretending to complete a Cloudflare "human verification" process. 

It has not been determined which initial infection source was employed, but it is believed that attackers may have utilized SEO poisoning, compromised websites, or malicious social media posts to redirect victims to a fake verification page that triggers the attack. As soon as the malware has been executed, it suppresses system notifications, hides the Terminal cursor, and silently downloads additional malicious components. 

A script initially executed acts as an orchestrator, downloading four separate components responsible for the theft of credentials, the theft of cryptocurrency, the collection of Keychain data, and the installation of a persistent backdoor, among others. After completing their tasks, data-stealing modules automatically delete themselves in order to reduce forensic evidence; however, the backdoor remains active to allow attackers long-term access to compromised computers.

In addition, it displays a false macOS password prompt based on the victim's actual username and an Apple-style interface in order to make it appear legitimate. After clicking the login button, ClickLock validates the credentials and immediately sends them to the attackers through Telegram. If the prompt is dismissed, the malware establishes persistence via LaunchAgents and repeatedly launches until the correct password is entered. 

System Lockdown and Data Theft

One of ClickLock's most disruptive features is its repeated termination of essential macOS processes, including Finder, Dock, Terminal, Activity Monitor, System Settings, Spotlight, and major web browsers. This malware continuously destroys these applications, causing users to be locked out of their computer for extended periods of time. 

According to researchers, ClickLock is able to exploit vulnerabilities in software without exploiting elevated privileges or exploiting software vulnerabilities. It relies on social engineering to persuade users to execute the malicious command themselves and repeatedly force them to interact with fake authentication prompts until they divulge their login credentials. 

Additionally to stealing login credentials, ClickLock attacks a wide range of sensitive information, including the following: 

  • Browser passwords, cookies, bookmarks, and autofill data. 
  • Cryptocurrency wallet files and browser wallet extensions. 
  • Password manager data. 
  • Shell histories and FileZilla FTP configurations. 
  • Basic system information and the victim's public IP address. 

It is the primary objective of the attackers to obtain the Chrome Safe Storage encryption key. By using this key, cybercriminals can decrypt stolen browser databases offline, allowing them to retrieve saved passwords, cookies, and other encrypted Chromium-based browser data without requiring continued access to the victim's computer. 

A modified version of the open-source GSocket tool is also installed by the malware, allowing attackers to gain persistent remote access to compromised devices by compressing collected data into ZIP archives and exfiltrating it through the Telegram Bot API. A legitimate system authorization prompt provides attackers with persistent remote access to compromised devices in addition to targeting macOS Keychain through a request for Chrome's Safe Storage encryption key. 

Using this malware, attackers can decrypt passwords, cookies, and other sensitive Chromium-based browser data offline if the user grants permission. Researchers noted that instead of exploiting software vulnerabilities, the malware's operators appear to rely exclusively on legitimate Mac OS features. 

ClickLock bypasses many of the operating system's built-in security protections through deception instead of technical exploit by convincing users to execute malicious commands. 

Staying Protected

ClickLock provides a limited detection window due to the fact that most of its components are deleted after execution and are hosted on compromised legitimate websites, according to Group-IB. It is strongly recommended that users should never copy and paste Terminal commands from websites or untrusted sources, regardless of their convincing appearance. Before investigating an infection on macOS, it is recommended that you force a shutdown by pressing the power button and restarting the device in Safe Mode.
Read more »
Subscribe to: Posts (Atom)