Show threadAndy Thompson (rainmaker)Feb 16

📬 Hackers Are Literally Mailing You Scam Letters 📬

Threat actors are sending physical letters through postal mail pretending to be from Trezor and Ledger, manufacturers of cryptocurrency hardware wallets. The letters use official-looking branding and urgent language to trick recipients into revealing their wallet recovery phrases on fake websites. The scam represents a sophisticated blend of physical and digital social engineering.

Sources:
• https://www.bleepingcomputer.com/news/security/snail-mail-letters-target-trezor-and-ledger-users-in-crypto-theft-attacks/
• https://www.cryptotimes.io/2026/02/16/ledger-and-trezor-users-are-being-tricked-into-giving-away-millions/
• https://crypto.news/crypto-hackers-target-trezor-ledger-users-in-theft/
• https://phemex.com/news/article/scammers-target-ledger-and-trezor-users-with-phishing-letters-60803

#Cryptocurrency #Trezor #Ledger #PhishingScam #HardwareWallet
----------

🤖 Trusted AI Tool Weaponized to Hack Macs 🤖

Threat actors are abusing Claude AI's Artifacts feature and Google Ads in ClickFix campaigns that deliver infostealer malware to macOS users. The attacks target users searching for specific technical queries, showing malicious Google Ads that lead to Claude-generated artifacts containing malware. This represents a concerning abuse of AI-generated content for malware distribution.

Sources:
• https://www.bleepingcomputer.com/news/security/claude-llm-artifacts-abused-to-push-mac-infostealers-in-clickfix-attack/
• https://cyberpress.org/malicious-campaign-uses-claude-artifacts-and-google-ads/
• https://www.rescana.com/post/claude-llm-artifacts-exploited-to-distribute-mac-infostealer-malware-via-clickfix-attack-chain-targe
• https://www.news4hackers.com/clickfix-attack-exploits-claude-llm-artifacts-to-distribute-mac-infostealers/

#Claude #MacMalware #Infostealer #GoogleAds #AI
----------

❄️ ShinyHunters Strikes Again: 600K Records Leaked ❄️

The notorious ShinyHunters data extortion group claims to have stolen more than 600,000 Canada Goose customer records containing personal and payment-related information. Canada Goose told BleepingComputer the dataset appears to relate to past customer transactions and investigators have not found evidence of a breach of Canada Goose's own systems. The company is investigating whether the data came from a third-party vendor or partner.

Sources:
• https://www.bleepingcomputer.com/news/security/canada-goose-investigating-as-hackers-leak-600k-customer-records/
• https://securityaffairs.com/188046/data-breach/shinyhunters-leaked-600k-canada-goose-customer-records-but-the-firm-denies-it-was-breached.html
• https://www.techradar.com/pro/security/canada-goose-confirms-data-leak-around-600-000-customers-thought-to-be-affected
• https://vpncentral.com/canada-goose-600k-customer-records-leaked-shinyhunters-claims-third-party-breach/

#DataBreach #CanadaGoose #ShinyHunters #CustomerData #CyberSecurity

Snail mail letters target Trezor and Ledger users in crypto-theft attacks

Threat actors are sending physical letters pretending to be from Trezor and Ledger, makers of cryptocurrency hardware wallets, to trick users into submitting recovery phrases in crypto theft attacks.

BleepingComputer
The DefendOps DiariesSep 22

Mac users, beware: cybercriminals are disguising fake password managers as trusted apps, tricking thousands and unleashing malware that robs your data and cash. How did this scam pull off such a breach?

https://thedefendopsdiaries.com/fake-password-managers-target-mac-users-in-2025-a-sophisticated-malware-campaign/

#macmalware
#passwordmanagersecurity
#phishingattacks
#osxadload
#cybersecurity2025

Fake Password Managers Target Mac Users in 2025: A Sophisticated Malware Campaign

Fake password managers targeting Mac users in 2025 spread sophisticated malware, causing financial losses and highlighting new cybersecurity threats.

The DefendOps Diaries
Cat of the CardsAug 5, 2025

#LinuxMalware is NOT a new thing.

#MacMalware isn't new either.

for every major #windows #Malware going around right now, there's variants of it that work on mac and many distros of linux

if you thought Mac or Linux was immune to malware you're an idiot

Tom's Hardware ItaliaJun 10, 2025

🚨Hai un Mac? Rimani al sicuro! Un nuovo malware è all'orizzonte, proteggi i tuoi dati. #CyberSecurity #MacMalware⚠️

🔗 https://www.tomshw.it/hardware/hai-un-mac-occhio-a-questo-malware-2025-06-10

Hai un Mac? Occhio a questo malware

Nuova campagna malware si spaccia per Spectrum per infettare i computer Mac con software dannoso attraverso tecniche di impersonificazione avanzate.

Tom's Hardware
malwr4n6Mar 9, 2025

🔍 Understanding #macos #malware is crucial for any professional today.

Check out my in-depth guide on analyzing PKG files to enhance your skills in macOS #malwareanalysis Analysis: https://www.malwr4n6.com/post/macos-malware-analysis-pkg-files

@blacktop

#macosx #macosmalware #apple #macmalware #guide #dfir

macOS Malware Analysis : PKG Files

An article on macOS Malware Analysis for PKG Files.

Malwr4n6
Tarnkappe.infoJan 22, 2025
📬 Neue Bedrohung für macOS: AmosStealer will eure Krypto-Wallets
#ITSicherheit #Malware #Cyberkriminalität #Datensicherheit #KryptoWallets #MacMalware #macOSSicherheit #PhishingAngriff https://sc.tarnkappe.info/e2d086
Neue Bedrohung für macOS: AmosStealer will eure Krypto-Wallets

Gefährliche Malware AmosStealer greift Mac-Benutzer an: Passwörter und Krypto-Wallets jetzt vor Diebstahl schützen!

TARNKAPPE.INFO
AppleX4Jan 11, 2025
🚨 Nuevo malware en #MacOS, “Banshee”, evade detección utilizando los propios métodos de cifrado de Apple. Detectado después de más de 2 meses, roba contraseñas de iCloud y criptomonedas. ¡Cuidado con lo que descargas! 🛡️ #SeguridadApple #MacMalware
NatyOct 22, 2024
Repost: #malware #macmalware #macOSSequoia
HM Surf macOS vuln potentially exploited by Adloader malware • The Register
https://www.theregister.com/2024/10/21/microsoft_macos_hm_surf/
macOS HM Surf vuln might already be under exploit by major malware family

Like keeping your camera and microphone private? Patch up

The Register
Cyber Tips GuideSep 3, 2024
Mac users! The new Cthulhu Stealer malware, available as a service for $500/month, targets macOS by posing as legit apps to steal passwords and crypto wallets. Protect your system in ten steps, read more 🔗 https://zurl.co/UIqw #MacMalware #CthulhuStealer #CyberSecurity.
Cthulhu Stealer Exposed: How It Targets Mac Users – Cyber Tips Guide

– In recent years, Mac users have increasingly become targets for cybercriminals. The perception that MacOS is inherently secure has led to a false sense of security among users, making them prime targets for sophisticated malware attacks. One such threat is the Cthulhu Stealer malware, part of a growing trend of info stealers targeting macOS devices. Cthulhu Stealer #malware targets Mac users by disguising itself as legitimate software, stealing sensitive data like passwords and cryptocurrency. Stay cyber safe.

Cyber Tips Guide – Making Sense of Cyber Safety
polaryseMay 18, 2024
Back with analysis of a late 2023 BlueNorOff MacOS sample. This was a great sample to understand some of the API calls malware leverages to extract information and send back to C2. https://polaryse.github.io/posts/bluenoroff-malware/
#macos #macmalware #ARM #YARA #Ghidra #reverseengineering #malware #APT #bluenoroff #lazarusgroup
Delving into BlueNorOff malware

In this article, we examine a newer strand of Bluenoroff malware from late 2023 on MacOS systems. It’s our first look at a strand of malware from an APT.