Here is another reason why you shouldn’t download cracked or pirated software to your macOS devices - there’s malware hiding within.
Cybersecurity researchers from Kaspersky are warning of a new piece of malware, built for the Apple ecosystem, being distributed on websites claiming to offer cracked applications.
Victims would download a PKG file, thinking they were getting an activator for a cracked app they previously downloaded. They would place the PKG in the /Applications/ folder, as part of the instructions to “activate” the cracked piece of software.
macOS malware strikes again
On the surface, the malware works as “intended” - the victim will get a bogus Activator window, asking for the administrator password. Granted, the malware proceeds to contact its command and control (C2) server and get a script capable of running arbitrary commands on the target endpoint.
An interesting thing about this malware is how it contacts the C2 server at the correct URL - it pulls words from two hardcoded lists and adds a random sequence of five letters as its third-level domain name. That way, the malicious activity is hidden inside normal traffic.
"With this URL, the sample made a request to a DNS server as an attempt to get a TXT record for the domain”, Kaspersky explained.
The final payload grants the attackers all kinds of advantages, from backdoor access, to information about the compromised system, and more. Among other things, the malware will look for Bitcoin Core and Exodus wallets on compromised devices, and if it finds them, replaces them with backdoored copies. Once the victim tries to log into their wallets again, they could have their funds drained almost instantly.
Kaspersky also said that while it was investigating the malware, the C2 came back with an upgraded version of the backdoor script, signaling continuous development. However, command execution was not yet available, Kaspersky said, suggesting that the malware is still work-in-progress.
Via BleepingComputer
More from TechRadar Pro
- MacOS devices are being hit by new malware strains - and they're able to quickly evolve to avoid detection
- Here's a list of the best firewalls around today
- These are the best endpoint security tools right now