Title: "💻🔒 #MacOSBackdoor: Stealthy Malware in Cracked Apps Drains Wallets via DNS Records 🚨"

Recent reports from Securelist and BleepingComputer reveal a sophisticated malware campaign targeting macOS users. Authored by Sergey Puzan (Securelist) and Bill Toulas (BleepingComputer), these articles uncover a cunning method where hackers disguise information-stealing malware within cracked macOS applications. This threat primarily affects macOS Ventura users and leverages DNS records to conceal malicious scripts. The malware, disguised as a legitimate app activator, prompts users for admin passwords, thus gaining control over the system.

The malware establishes contact with its command and control (C2) server via a unique URL, generated by combining words from hardcoded lists with random letters, and then fetches a base64-encoded Python script from DNS TXT records. This script not only provides backdoor access but also harvests and transmits critical system information. Further, it ensures persistence across reboots and continuously updates itself.

What's alarming is the malware's capability to replace Bitcoin Core and Exodus wallets with compromised versions that transmit users' sensitive data to the attackers. The ingenuity of hiding the payload in DNS server TXT records marks a new level of sophistication in cyber attacks.

Stay vigilant and avoid cracked software to mitigate such threats!

Tags: #CyberSecurity #Infosec #MalwareAnalysis #MacOS #DNSRecords #PythonScript #APT #Securelist #BleepingComputer #SergeyPuzan #BillToulas

Sources:

• Securelist: Sergey Puzan's Article
• BleepingComputer: Bill Toulas's Article