{"id":69643,"date":"2024-01-24T03:36:27","date_gmt":"2024-01-24T07:36:27","guid":{"rendered":"https:\/\/coinscreed.com\/staging\/?p=69643"},"modified":"2024-01-24T03:42:28","modified_gmt":"2024-01-24T07:42:28","slug":"macbook-users-in-crypto-space-targeted-by-malware-attack","status":"publish","type":"post","link":"https:\/\/coinscreed.com\/staging\/macbook-users-in-crypto-space-targeted-by-malware-attack\/","title":{"rendered":"Macbook Users in Crypto Space Targeted by Malware Attack"},"content":{"rendered":"\n

A new malware attack discovered by Kaspersky targets Macbook users<\/a> in the crypto space by repacking pre-cracked applications with a Trojan proxy and a post-installation script. The malware executes arbitrary commands and steals sensitive information from the infected system.<\/p>\n\n\n\n

\"Macbook<\/figure>\n\n\n\n

Researchers from Kaspersky \r\n \r\n \r\n \r\n <\/g>\r\n \r\n \r\n \r\n <\/clipPath>\r\n <\/defs><\/svg><\/span><\/a>found a new malware attack for Macbook users who work with cryptocurrency. The malware is hidden in pirated software that hackers give away for free. People who want apps for free download them without realizing there is malware inside.<\/p>\n\n\n\n

Once users attempt to install the cracked applications, they unknowingly trigger the infection process. The infected installation package displays a window with installation instructions, asking them to copy the application to the \/Applications\/ directory <\/strong>and launch an application called \u201cActivator.\u201d<\/strong><\/p>\n\n\n\n

Activator, however, is not a genuine application but a malware component that prompts users to enter a password, effectively granting the malware administrator privileges. Upon execution, the malware checks the system for an installed copy of Python 3<\/use><\/svg><\/span><\/a> and, if absent, installs a previously copied version of Python 3 from the Macbook operating system directory.<\/p>\n\n\n\n

The malware then \u201cpatches\u201d<\/strong> the downloaded app by comparing the modified executable with a sequence hardcoded inside Activator. If a match is found, the malware removes the initial bytes, making the application appear cracked and functional to the user. <\/p>\n\n\n\n

However, this is only a deception, as the malware initiates its main payload.<\/p>\n\n\n\n

What the Malware Does<\/h3>\n\n\n\n

The infected sample establishes communication with a command-and-control (C2) server by generating a unique web address through a combination of hardcoded words and a random third-level domain name. <\/p>\n\n\n\n

This method lets the malware conceal its activities within normal DNS server traffic, ensuring the payload download.<\/p>\n\n\n\n

The decrypted script obtained from the C2 server reveals that the malware operates by executing arbitrary commands received from the server. These commands are often delivered as Base64-encoded Python scripts.<\/p>\n\n\n\n

Furthermore, the malware harvests sensitive information<\/use><\/svg><\/span><\/a> from the infected system, including the operating system version, user directories, list of installed applications, CPU type, and external IP address. The gathered data is then sent back to the server.<\/p>\n\n\n\n

How to Protect Your Macbook from the Malware Attack<\/h3>\n\n\n\n

According to Kaspersky, the malware attack is still active and poses a serious threat to Macbook users in the crypto space. The cybersecurity firm advises users to avoid downloading applications from untrusted sources, especially those that claim to be pre-cracked or offer paid features for free.<\/p>\n\n\n\n

Users could also install a reliable antivirus software and keep it updated, as well as scan their system regularly for any signs of infection. <\/p>\n\n\n\n

Macbook users should also be wary of suspicious password or permission requests and report any anomalies to their antivirus vendor.<\/p>\n","protected":false},"excerpt":{"rendered":"

A new malware attack discovered by Kaspersky targets Macbook users in the crypto space by repacking pre-cracked applications with a Trojan proxy and a post-installation script. The malware executes arbitrary commands and steals sensitive information from the infected system. Researchers from Kaspersky found a new malware attack for Macbook users who work with cryptocurrency. The […]<\/p>\n","protected":false},"author":44,"featured_media":69645,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[21,11476],"tags":[16269,18018,18017],"class_list":["post-69643","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news","category-hacks-and-scams","tag-crypto-malware","tag-kapersky","tag-macbook"],"jetpack_featured_media_url":"https:\/\/coinscreed.com\/staging\/wp-content\/uploads\/2024\/01\/macbook-malware.webp","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/posts\/69643","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/users\/44"}],"replies":[{"embeddable":true,"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/comments?post=69643"}],"version-history":[{"count":0,"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/posts\/69643\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/media\/69645"}],"wp:attachment":[{"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/media?parent=69643"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/categories?post=69643"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/tags?post=69643"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}