Cybersecurity researchers have uncovered a set of malicious artifacts that they say is part of a sophisticated toolkit targeting Apple macOS systems.
“As of now, these samples are still largely undetected and very little information is available about any of them,” Bitdefender researchers Andrei Lapusneanu and Bogdan Botezatu said in a preliminary report published on Friday.
The Romanian firm’s analysis is based on an examination of four samples that were uploaded to VirusTotal by an unnamed victim. The earliest sample dates back to April 18, 2023.
Two of the three malicious programs are said to be generic Python-based backdoors that are designed to target Windows, Linux, and macOS systems. The payloads have been collectively dubbed JokerSpy.
On devices running macOS, Base64-encoded content retrieved from the server is written to a file named “/Users/Shared/AppleAccount.tgz” that’s subsequently unpacked and launched as the “/Users/Shared/TempUser/AppleAccountAssistant.app” application.
The same routine, on Linux hosts, validates the operating system distribution by checking the “/etc/os-release” file. It then proceeds to write C code to a temporary file “tmp.c,” which is compiled to a file called “/tmp/.ICE-unix/git” using the cc command on Fedora and gcc on Debian.
The third component is a FAT binary known as xcc that’s written in Swift and targets macOS Monterey (version 12) and newer. The file houses two Mach-O files for the twin CPU architectures, x86 Intel and ARM M1.
xcc’s spyware connections stem from a path identified within the file content, “/Users/joker/Downloads/Spy/XProtectCheck/” and the fact that it checks for permissions such as Disk Access, Screen Recording, and Accessibility.
The identity of the threat actors behind the activity is unknown as yet. It’s currently also not clear how initial access is obtained, and if it involves an element of social engineering or spear-phishing.
Source: https://thehackernews.com/
