Source: www.securityweek.com – Author: Ionut Arghire
A newly identified information stealer malware targeting macOS users is being distributed through a compromised website as a browser update, Proofpoint reports.
The malware, dubbed FrigidStealer, is written in the Go programming language and was built with the WailsIO project, to render content in the victim’s browser and hide its malicious intent.
Upon execution, it prompts the user for their password, and proceeds to harvest browser cookies and files associated with passwords and cryptocurrency, as well as Apple Notes, and exfiltrates them to its command-and-control (C&C) server.
Distributed by a financially motivated cybercriminal group tracked as TA2727 since the end of January, FrigidStealer is targeting macOS users outside of North America who visit the compromised website, Proofpoint says.
A script injected into the website redirects the visitors to a fake update page where they are prompted to click a fake update button, which leads to the download of a DMG file that the user is encouraged to mount.
If the user opens the file, they are shown an icon for Chrome or Safari, depending on the browser they use, and are instructed to run the application by right clicking the icon, an action designed to bypass Apple’s Gatekeeper protections.
TA2727 was seen employing the same tactics, techniques, and procedures (TTPs) in other campaigns targeting Windows users with Lumma Stealer and DeerStealer, and Android users with the Marcher banking trojan.
According to Proofpoint, users were redirected to websites injected with the malicious code from a traffic distribution service (TDS) operated by a traffic seller tracked as TA2726, which is also redirecting traffic to domains leading to SocGholish, a malware family operated by Russian cybercriminals.
Advertisement. Scroll to continue reading.
Active since at least September 2022, TA2726 is likely responsible for webserver and website compromises that are then shared with other cybercrime groups. Since the beginning of the year, the threat actor has used the TDS to redirect traffic to TA569 and TA2727 web injects.
“Proofpoint is able to identify TA2726 activity distinctly from other threat actors based on the actor’s infrastructure including the use of Keitaro and consistent domain patterns and IP addresses,” the cybersecurity firm notes.
Related: Homebrew macOS Users Targeted With Information Stealer Malware
Related: Cybercrime’s Silent Operator: The Unraveling of VexTrio’s Malicious Network Empire
Related: New BadSpace Backdoor Deployed in Drive-By Attacks
Related: RedLine and Meta Infostealers Disrupted by Law Enforcement
Original Post URL: https://www.securityweek.com/new-frigidstealer-macos-malware-distributed-as-fake-browser-update/
Category & Tags: Malware & Threats,FrigidStealer,macOS malware,malware – Malware & Threats,FrigidStealer,macOS malware,malware
Views: 3
