New macOS Malware Drains Crypto Wallets via ClickFix attacks

[cryptomaniac_xxx]

A recent Go-based malware was recently discovered by security researchers at Huntress. The primary targets are again MacOS users (recently there has been a spike on this kind of attacks), stealing cryptocurrency assets, browser-stored passwords, Apple Keychain data, and cached credentials.

It starts with a email from the criminals with a link instructing them to run a command in Terminal. It's a bash script that acts as a malware loaded. It then collects system information. The infostealing and crypto-draining payload will write itself to the directory under the name com.apple.verified, and the com.apple.quarantine extended attribute was stripped to prevent Gatekeeper from flagging the file as quarantined and triggering a security warning upon execution.



It also acts as a copy and paste stealer and this is the address belonging to the criminals:



And then the obvious modus, steal our crypto:

A function called DRAIN would identify likely wallet addresses tied to these various cryptocurrencies and query the blockchain to determine if the wallet has a balance; if the malware finds a wallet address, it retrieves an alternative wallet address (either from an embedded, hardcoded list in the binary, or from its C2 server) and can steal either a portion (indicated by the variable DRAIN_PCT) or the entire contents of the wallet, transferring the value to a wallet controlled by the threat actor.

So if you are a MacOS user, be careful on emails that you might have received or going to received moving forward. With so many spats of attack, everyone should really be very careful.

https://www.huntress.com/blog/mac-crypto-draining-malware

[Porfirii]

-snip-

(recently there has been a spike on this kind of attacks)

-snip-

Gone are the days when macOS users could rest easy because there were hardly any viruses that could infect their devices, and the number of vulnerabilities that are being reported lately in this section, specific to Mac, is alarming.

Thanks for the warning cryptomaniac_xxx, we will have to be extremely cautious when checking our email inbox.

[sunsilk]

Gone are the days when macOS users could rest easy because there were hardly any viruses that could infect their devices, and the number of vulnerabilities that are being reported lately in this section, specific to Mac, is alarming.

Well, the hackers are also migrating to where many users are comfortable with their OS and it's not only with the macOS but also their app store where fake wallet apps are uploaded for the victims to download.

I guess that not even Apple's ecosystem is no longer safe from these drainers.

Even the linux distro's, these hackers are choosing every OS where potential victims are there.

[348Judah]

If we are very sensitive and pay attention to some of the devices we use, sometimes they do give us signals or warnings towards any infestation of a malware on those devices, because some are built to easily detect for such before they could pose harm to the device and also spread to detargeted areas, I will advice we remain more proactive when it comes to sensitivity in this manner over any external threat.

[KiaKia]

This is not new, Either it's MacOs or even Linux OS which some people consider to be safer than others it doesn't matter, social engineering attacks knows no OS, they designed this hacks and spread them through fake CAPTHA, once you click it the hack runs malicious terminal command, and the rest is history.

This type of attack is also happening on windows and others too, if you are keeping your software wallet on a PC it's safer you don't use that same PC to browse the internet.

This is why I always recommend hardware wallet simply because they expose you to less dangers compared to running crypto wallets on the same devices that you are using to browse the internet.

[Moreno233]

If we are very sensitive and pay attention to some of the devices we use, sometimes they do give us signals or warnings towards any infestation of a malware on those devices, because some are built to easily detect for such before they could pose harm to the device and also spread to detargeted areas, I will advice we remain more proactive when it comes to sensitivity in this manner over any external threat.

I understand that your point is that if users avoid clicking suspicious links, they can escape this type of threat but with the latest trend, you cannot be careful enough because some of these attacks are sophisticated. I'm not saying that basic security principles should be ignored but we can only pray and hope not to be victims of some of these attacks because some of them really leaves victims no option for escape.

[PrivacyG]

because some of these attacks are sophisticated.

we can only pray and hope not to be victims of some of these attacks because some of them really leaves victims no option for escape.

Seriously.  What is so 'sophisticated' about this scam?  The victims were asked to run a COMMAND in the TERMINAL.  Which unless you know what you are doing, you should NOT DO!

What is next!  A bunch of people hospitalized because a fake e-mail told them to drink bleach to predict Bitcoin charts better?  Some of these are really stupid, the victim is doing all the steps with their own hands!

[DYING_S0UL]

because some of these attacks are sophisticated.

we can only pray and hope not to be victims of some of these attacks because some of them really leaves victims no option for escape.

Seriously.  What is so 'sophisticated' about this scam?  The victims were asked to run a COMMAND in the TERMINAL.  Which unless you know what you are doing, you should NOT DO!

What is next!  A bunch of people hospitalized because a fake e-mail told them to drink bleach to predict Bitcoin charts better?  Some of these are really stupid, the victim is doing all the steps with their own hands!

Again? LOL.

I see red flags all over this attack trick/method! I mean, anything that tells you to type something into your terminal should be the biggesttt redddddest flag ever. I genuinely wonder how people actually fall for this stuff. No offense, but one has to be really stupid/naive or someone who have absolute zero knowledge on how a computer works or someone who never operated one, to fall for such scam methods. This is one of the most basic knowledge, never copy paste anything into the terminal that you aren't sure of, or even touch the terminal as it's for advance users. I guess, the world has no shortage of such people, otherwise this kind of "not so sophisticated" methods wouldn't have existed in the first place...

[retreat]

-snip-
It starts with a email from the criminals with a link instructing them to run a command in Terminal. It's a bash script that acts as a malware loaded. It then collects system information.
-snip-

So basically, everyone who fell victim to this was simply tricked by the hackers into running commands on their Macs, which I think is pretty funny and pretty stupid. Because how could they not have been even a little suspicious about running commands on their devices from suspicious emails? Even anything from an email you don't recognize needs to be treated with suspicion and think twice before opening it, let alone clicking links and executing commands. It's clear that the victims were stupid to follow all of those commands.

[RGBTC]

I understand that your point is that if users avoid clicking suspicious links, they can escape this type of threat but with the latest trend, you cannot be careful enough because some of these attacks are sophisticated. I'm not saying that basic security principles should be ignored but we can only pray and hope not to be victims of some of these attacks because some of them really leaves victims no option for escape.

They simply change the method used to gain access to your device, as well as the wording or steps designed to trick you into taking action. If I recall correctly, a recent fake CAPTCHA scheme also attempted to trick users into executing commands in the terminal.
You should be suspicious if any service or third party pressures you to do something unusual. In this specific attack, the request clearly makes no sense; security notifications are simply not ever sent via email.

[DPHOR]

If we are very sensitive and pay attention to some of the devices we use, sometimes they do give us signals or warnings towards any infestation of a malware on those devices, because some are built to easily detect for such before they could pose harm to the device and also spread to detargeted areas, I will advice we remain more proactive when it comes to sensitivity in this manner over any external threat.

I understand that your point is that if users avoid clicking suspicious links, they can escape this type of threat but with the latest trend, you cannot be careful enough because some of these attacks are sophisticated. I'm not saying that basic security principles should be ignored but we can only pray and hope not to be victims of some of these attacks because some of them really leaves victims no option for escape.

I do not understand.. anyone out there is liable for the actions and risk level and you can prevent most of the scam if you are that careful enough not to keep clicking on links that are suspicious or suspected to scam link.
Like I does, I barely clicked on links that are posted here and even if I know that I should be click on that but for my personal safety I have no options than to completely avoid it because I know the implications that is involved if proper precautions aren't taken.

[tech30338]

They actually not change how things work they just add and tweak it so that people will think its not a fraud one, but the email and link are still the old process,.
Make sure never run terminal commands most especially if its been email, real technical person will not let you do this they are the one who will run this if its legit, also learn the basics when you have  a device, it will help you understand what people are letting you do.
Or better ignore email clicking link and doing command request to be run from unknown people or even known people they might just be inpersonating.

[fullfitlarry]

They actually not change how things work they just add and tweak it so that people will think its not a fraud one, but the email and link are still the old process,.
Make sure never run terminal commands most especially if its been email, real technical person will not let you do this they are the one who will run this if its legit, also learn the basics when you have  a device, it will help you understand what people are letting you do.
Or better ignore email clicking link and doing command request to be run from unknown people or even known people they might just be inpersonating.

Right, even though it looks like the attack is sophisticated, one thing remains that same, the way they uses email as their point of entry. And so with that, crypto enthusiast should know this by now.

Practice security hygiene like not clicking anything on our email even if we say that we know the person itself. Specially those unsolicited emails like in this case. Because just one mistakes and it means our crypto is gone in a blink of an eye.