A new information stealer malware called MetaStealer has set its sights on Apple macOS, making the latest in a growing list of stealer families focused on the operating system after MacStealer, Pureland, Atomic Stealer, and Realst.
“Threat actors are proactively targeting macOS businesses by posing as fake clients in order to socially engineer victims into launching malicious payloads,” SentinelOne security researcher Phil Stokes said in a Monday analysis.
In these attacks, MetaStealer is distributed in the form of rogue application bundles in the disk image format (DMG), with targets approached through threat actors posing as prospective design clients in order to share a password-protected ZIP archive containing the DMG file.
The main component of the payload is an obfuscated Go-based executable that comes with features to harvest data from iCloud Keychain, saved passwords, and files from the compromised host. All the samples observed so far are designed for Intel-based macOS machines.
Select versions of the malware have been observed containing functions that likely target Telegram and Meta services.
SentinelOne said it observed some MetaStealer variants impersonating TradingView, the same tactic that has been adopted by Atomic Stealer in recent weeks.
This raises two possibilities: Either the same malware authors could be behind both the stealer families and have been adopted by different threat actors due to differences in the delivery mechanism, or they are the handiwork of disparate sets of actors.
“The appearance of yet another macOS infostealer this year shows the trend towards targeting Mac users for their data continues to rise in popularity among threat actors,” Stokes said.
Source: https://thehackernews.com/
