New macOS Malware Drains Crypto Wallets via ClickFix attacks

[cryptomaniac_xxx]

A recent Go-based malware was recently discovered by security researchers at Huntress. The primary targets are again MacOS users (recently there has been a spike on this kind of attacks), stealing cryptocurrency assets, browser-stored passwords, Apple Keychain data, and cached credentials.

It starts with a email from the criminals with a link instructing them to run a command in Terminal. It's a bash script that acts as a malware loaded. It then collects system information. The infostealing and crypto-draining payload will write itself to the directory under the name com.apple.verified, and the com.apple.quarantine extended attribute was stripped to prevent Gatekeeper from flagging the file as quarantined and triggering a security warning upon execution.



It also acts as a copy and paste stealer and this is the address belonging to the criminals:



And then the obvious modus, steal our crypto:

A function called DRAIN would identify likely wallet addresses tied to these various cryptocurrencies and query the blockchain to determine if the wallet has a balance; if the malware finds a wallet address, it retrieves an alternative wallet address (either from an embedded, hardcoded list in the binary, or from its C2 server) and can steal either a portion (indicated by the variable DRAIN_PCT) or the entire contents of the wallet, transferring the value to a wallet controlled by the threat actor.

So if you are a MacOS user, be careful on emails that you might have received or going to received moving forward. With so many spats of attack, everyone should really be very careful.

https://www.huntress.com/blog/mac-crypto-draining-malware

[Porfirii]

-snip-

(recently there has been a spike on this kind of attacks)

-snip-

Gone are the days when macOS users could rest easy because there were hardly any viruses that could infect their devices, and the number of vulnerabilities that are being reported lately in this section, specific to Mac, is alarming.

Thanks for the warning cryptomaniac_xxx, we will have to be extremely cautious when checking our email inbox.

[sunsilk]

Gone are the days when macOS users could rest easy because there were hardly any viruses that could infect their devices, and the number of vulnerabilities that are being reported lately in this section, specific to Mac, is alarming.

Well, the hackers are also migrating to where many users are comfortable with their OS and it's not only with the macOS but also their app store where fake wallet apps are uploaded for the victims to download.

I guess that not even Apple's ecosystem is no longer safe from these drainers.

Even the linux distro's, these hackers are choosing every OS where potential victims are there.

[348Judah]

If we are very sensitive and pay attention to some of the devices we use, sometimes they do give us signals or warnings towards any infestation of a malware on those devices, because some are built to easily detect for such before they could pose harm to the device and also spread to detargeted areas, I will advice we remain more proactive when it comes to sensitivity in this manner over any external threat.

[KiaKia]

This is not new, Either it's MacOs or even Linux OS which some people consider to be safer than others it doesn't matter, social engineering attacks knows no OS, they designed this hacks and spread them through fake CAPTHA, once you click it the hack runs malicious terminal command, and the rest is history.

This type of attack is also happening on windows and others too, if you are keeping your software wallet on a PC it's safer you don't use that same PC to browse the internet.

This is why I always recommend hardware wallet simply because they expose you to less dangers compared to running crypto wallets on the same devices that you are using to browse the internet.

[Moreno233]

If we are very sensitive and pay attention to some of the devices we use, sometimes they do give us signals or warnings towards any infestation of a malware on those devices, because some are built to easily detect for such before they could pose harm to the device and also spread to detargeted areas, I will advice we remain more proactive when it comes to sensitivity in this manner over any external threat.

I understand that your point is that if users avoid clicking suspicious links, they can escape this type of threat but with the latest trend, you cannot be careful enough because some of these attacks are sophisticated. I'm not saying that basic security principles should be ignored but we can only pray and hope not to be victims of some of these attacks because some of them really leaves victims no option for escape.

[PrivacyG]

because some of these attacks are sophisticated.

we can only pray and hope not to be victims of some of these attacks because some of them really leaves victims no option for escape.

Seriously.  What is so 'sophisticated' about this scam?  The victims were asked to run a COMMAND in the TERMINAL.  Which unless you know what you are doing, you should NOT DO!

What is next!  A bunch of people hospitalized because a fake e-mail told them to drink bleach to predict Bitcoin charts better?  Some of these are really stupid, the victim is doing all the steps with their own hands!

[DYING_S0UL]

because some of these attacks are sophisticated.

we can only pray and hope not to be victims of some of these attacks because some of them really leaves victims no option for escape.

Seriously.  What is so 'sophisticated' about this scam?  The victims were asked to run a COMMAND in the TERMINAL.  Which unless you know what you are doing, you should NOT DO!

What is next!  A bunch of people hospitalized because a fake e-mail told them to drink bleach to predict Bitcoin charts better?  Some of these are really stupid, the victim is doing all the steps with their own hands!

Again? LOL.

I see red flags all over this attack trick/method! I mean, anything that tells you to type something into your terminal should be the biggesttt redddddest flag ever. I genuinely wonder how people actually fall for this stuff. No offense, but one has to be really stupid/naive or someone who have absolute zero knowledge on how a computer works or someone who never operated one, to fall for such scam methods. This is one of the most basic knowledge, never copy paste anything into the terminal that you aren't sure of, or even touch the terminal as it's for advance users. I guess, the world has no shortage of such people, otherwise this kind of "not so sophisticated" methods wouldn't have existed in the first place...

[retreat]

-snip-
It starts with a email from the criminals with a link instructing them to run a command in Terminal. It's a bash script that acts as a malware loaded. It then collects system information.
-snip-

So basically, everyone who fell victim to this was simply tricked by the hackers into running commands on their Macs, which I think is pretty funny and pretty stupid. Because how could they not have been even a little suspicious about running commands on their devices from suspicious emails? Even anything from an email you don't recognize needs to be treated with suspicion and think twice before opening it, let alone clicking links and executing commands. It's clear that the victims were stupid to follow all of those commands.

[RGBTC]

I understand that your point is that if users avoid clicking suspicious links, they can escape this type of threat but with the latest trend, you cannot be careful enough because some of these attacks are sophisticated. I'm not saying that basic security principles should be ignored but we can only pray and hope not to be victims of some of these attacks because some of them really leaves victims no option for escape.

They simply change the method used to gain access to your device, as well as the wording or steps designed to trick you into taking action. If I recall correctly, a recent fake CAPTCHA scheme also attempted to trick users into executing commands in the terminal.
You should be suspicious if any service or third party pressures you to do something unusual. In this specific attack, the request clearly makes no sense; security notifications are simply not ever sent via email.

[DPHOR]

If we are very sensitive and pay attention to some of the devices we use, sometimes they do give us signals or warnings towards any infestation of a malware on those devices, because some are built to easily detect for such before they could pose harm to the device and also spread to detargeted areas, I will advice we remain more proactive when it comes to sensitivity in this manner over any external threat.

I understand that your point is that if users avoid clicking suspicious links, they can escape this type of threat but with the latest trend, you cannot be careful enough because some of these attacks are sophisticated. I'm not saying that basic security principles should be ignored but we can only pray and hope not to be victims of some of these attacks because some of them really leaves victims no option for escape.

I do not understand.. anyone out there is liable for the actions and risk level and you can prevent most of the scam if you are that careful enough not to keep clicking on links that are suspicious or suspected to scam link.
Like I does, I barely clicked on links that are posted here and even if I know that I should be click on that but for my personal safety I have no options than to completely avoid it because I know the implications that is involved if proper precautions aren't taken.

[tech30338]

They actually not change how things work they just add and tweak it so that people will think its not a fraud one, but the email and link are still the old process,.
Make sure never run terminal commands most especially if its been email, real technical person will not let you do this they are the one who will run this if its legit, also learn the basics when you have  a device, it will help you understand what people are letting you do.
Or better ignore email clicking link and doing command request to be run from unknown people or even known people they might just be inpersonating.

[fullfitlarry]

They actually not change how things work they just add and tweak it so that people will think its not a fraud one, but the email and link are still the old process,.
Make sure never run terminal commands most especially if its been email, real technical person will not let you do this they are the one who will run this if its legit, also learn the basics when you have  a device, it will help you understand what people are letting you do.
Or better ignore email clicking link and doing command request to be run from unknown people or even known people they might just be inpersonating.

Right, even though it looks like the attack is sophisticated, one thing remains that same, the way they uses email as their point of entry. And so with that, crypto enthusiast should know this by now.

Practice security hygiene like not clicking anything on our email even if we say that we know the person itself. Specially those unsolicited emails like in this case. Because just one mistakes and it means our crypto is gone in a blink of an eye.

[freedomgo]

Thanks for the warning, but for me this is quite basic. If someone really values the information on their computer, especially when it could affect their assets, they should already know that entering an admin password for something suspicious is a bad setup.

The moment something asks for my admin password without a very clear reason, I would already stop there. I would never continue with that.

Actually, I dont even install third-party antivirus on my PC. I just use whatever security features already come with the OS.
I'm not a macOS user, but I think the basic concept is still the same.

[Upgrade00]

Gone are the days when macOS users could rest easy because there were hardly any viruses that could infect their devices, and the number of vulnerabilities that are being reported lately in this section, specific to Mac, is alarming.

If anyone would run a command from a link in an unsolicited email address, they were never safe irrespective of the device they're using.
If you click a random link and the next prompt requires you to enter administrator password, you, close that  scan your device and consider that email address to be compromised.

[abaeze]

No OS is as safe as before as a target for hackers, earlier hackers were more capable of targeting Windows, now they can equally send malware to operating systems like macOS, ChromeOS, Linux. The most frightening thing is that those who are infected start following the hacker's command without concerning it and the malware enters the user's OS and starts looking for passwords, Apple Keychain information in the case of macOS users, browser credentials and crypto wallet related information. Not only that, it also works as a copy-paste stealer.That is, if you copy a Bitcoin/crypto address, the malware can identify it and change it with the hacker's address. Earlier, it was not possible to attack very easily by analyzing all these data but now reasoning AI, it has become much easier for hackers to do these things.

Eventually, as technology improves and no matter how many OSes are updated due to concerns about its security, hackers are also updating more and more about security, it has now become like a kind of crypto user VS hacker playing cops and robbers.

[qwertyup23]

-snip-

(recently there has been a spike on this kind of attacks)

-snip-

Gone are the days when macOS users could rest easy because there were hardly any viruses that could infect their devices, and the number of vulnerabilities that are being reported lately in this section, specific to Mac, is alarming.

Thanks for the warning cryptomaniac_xxx, we will have to be extremely cautious when checking our email inbox.

To be honest, this is the main consideration on why I purchased my late MacBook Air (2014) because I heard that you won't ever need to install any kind of malware protection program. Well from the looks of it, not only is our technology getting advanced, also scams have upgraded their schemes to infiltrate even the tightest of securities.

I wonder how Apple would respond to this problem given that they really brand themselves as virus-proof. Though the scam seems to initiate once the user falls from the unexpected error (thus, user has the control on how the virus would be downloaded), still, Apple needs to do something about these types of problems.

<..snip..>
Eventually, as technology improves and no matter how many OSes are updated due to concerns about its security, hackers are also updating more and more about security, it has now become like a kind of crypto user VS hacker playing cops and robbers.

I do think that Apple has the capability of resolving this issue. I mean, they are a trillion-dollar company in which they can utilize all the resources and exhaust all possible remedies to find a solution for this.

[MisFoxie]

So basically, everyone who fell victim to this was simply tricked by the hackers into running commands on their Macs, which I think is pretty funny and pretty stupid. Because how could they not have been even a little suspicious about running commands on their devices from suspicious emails? Even anything from an email you don't recognize needs to be treated with suspicion and think twice before opening it, let alone clicking links and executing commands. It's clear that the victims were stupid to follow all of those commands.

There are some dumb people who panic very quickly, and they are the ones who mostly click on links coming from unknown emails. When they click the link later they're asked to solve captcha in the process of solving it fake error appear and want user to copy the code and run in terminal, Those panicked people think that it can be fixed by simply entering that command in Terminal (it is basically like an auto repair).

Code:

Email link -> familiar looking webpage -> fake CAPTCHA -> verification instructions -> user copies command -> user pastes into Terminal -> malware executes

Anyway, those who are a little cautious and have some basic security knowledge would never fall for such a simple social engineering scam.

[Pumpsta]

It's frightening how many scams pop out lately :/ Even for macOS... nothing's getting us to safety anymore, not even the system that's supposed to be impossible to hack.... I hate that now you need to be an advanced user to be safe, this'll affect adoption for sure.

[crwth]

Hmm, opening a suspicious email should already be a red flag, and having to run a command in Terminal- that's even worse. It's important to have that security and protection set up in place so you wouldn't have to worry about it.

In terms of protection, it's still best to use multi-signature wallets if you have large amounts of funds to store. So even if one device or malware is affected, it's not enough and could significantly reduce the risk of theft.

There are modern authentication protections, right? Like passkeys and hardware security keys. That's a great thing to use for protection.