Mac users duped with FrigidStealer posing as browser updates – Source: www.csoonline.com

Hackers are seen dropping a new macOS infoStealer, FrigidStealer, on unsuspecting systems in a web inject campaign that uses fake browser updates to lure victims.

Researchers at Proofpoint reported observing two new threat actors, TA2726 and TA2727, running this campaign to steal sensitive browser data.

“Proofpoint identified and named two new cybercriminal threat actors operating components of web inject campaigns, including the one that delivers a new MacOS malware, FrigidStealer,” the researchers said in a blog post. “The web inject campaign landscape is increasing, with a variety of copycat threat actors conducting similar campaigns, which can make it difficult for analysts to track.”

A web inject campaign is a type of cyberattack where malicious code is injected into a legitimate website or web application to manipulate its content, steal sensitive information, or trick users into performing unauthorized actions.

Historically, these kinds of attacks were almost exclusively attributed to TA569— a threat actor primarily identified with SocGholish malware. But other “copycats” have recently picked up the TTPs to deliver a host of other malware.

Malware poses as browser updates

Researchers observed threat actors using fake browser updates to trick victims into downloading malware. Mac users downloaded a DMG file masked as a browser update, tricking them into manually overriding Apple’s Gatekeeper and installing FrigidStealer.

“Upon execution, FrigidStealer uses Apple script files and osascript to prompt the user to enter their password, and then to gather data including browser cookies, files with extensions relevant to password material or cryptocurrency from the victim’s Desktop and Documents folders, and any Apple Notes the user has created,” Proofpoint researchers added.

The campaign also accommodates Windows and Android attacks with targeted payloads. TA2726, which acts as a traffic distribution system (TDS) in the attack chain, redirects users to malware based on location and device type. The group enables malware distributors like TA569 and TA727 to deliver malware by compromising websites and inserting rogue JavaScript into web pages serving as fake updates.

For instance, in the attacks seen by Proofpoint, TDS redirected North American visitors to SocGholish malware, while other regions received TA2727 payloads like Lumma Stealer (Windows), DeerStealer (Windows), FrigidStealer (Mac), and Marcher (Android).

Detection can be tricky

The malware targeting Mac users uses the WailsIO framework, a Go-based framework for building lightweight desktop applications with HTML, CSS, and JavaScript, to appear legitimate.

These attacks “can be hard for security teams to detect and prevent and may present difficulties with communicating the threat to end users due to the social engineering techniques and website compromises used by the threat actor,” researchers cautioned in the blog.

Deploying network detection and endpoint protection, conducting user training programs, and implementing browser restriction and isolation could be the best ways to protect from these attacks, the blog added. It also included a list of indicators of compromise (IoC) for security teams to add to their threat scanners.

FrigidStealer collects browser data, credentials, and passwords from Safari and Chrome, along with system documents like Apple Notes, and crypto wallet data, and packs them into folders in the home directory to be exfiltrated to an actor-controlled C2 at “askforupdate[.]org.”

Proofpoint added that MacOS information stealers are increasing, indicating a growing adversarial focus on enterprise Mac users. Recently, researchers from SentinelOne discovered a new variant of the macOS Ferret family of malware, the North Korea-linked backdoors and stealers delivered through the infamous “Contagious Interviews” campaign.