Security researchers discovered a new JaskaGO malware stealer that can infect both Windows and macOS. JaskaGO uses various methods to persist in the infected system.
Researchers observed various malware versions impersonating installers for legitimate software like CapCut video editor, AnyConnect, and some security tools.
The malware is crafted in Golang and is part of a larger trend that uses this simple and easy-to-use programming language.
It is just as dangerous for macOS as it is for Windows.
Once it ensures it will go undetected by traditional antiviruses, the JaskaGo malware starts collecting information from the infected system.
JaskaGo malware can ensure persistence both on Windows and macOS operating systems.
It configures the file to execute automatically every time you restart Windows.
For that, it launches a PowerShell process that executes the malware.
The 4 steps process to persist on macOS. Step 1 - Execute as Root.
Step 4 - Creates LaunchDaemon/ LaunchAgent Creation so that the malware automatically launches during the system startup.
How to prevent or respond to a JaskaGo malware infection.
Researchers warn that the JaskaGo malware can go undetected by traditional antiviruses.
I recommend using an XDR solution to keep your system safe from this sort of sophisticated malware.
Use a DNS security tool to detect and block on spot any malicious communication attempt.
By using a DNS filtering solution, the attacker will fail to install malware on your endpoints.
If they somehow succeed infecting your devices, stopping communication to a malicious domain will make data exfiltration to a C&C server impossible.
Educate employees to identify phishing emails and avoid clicking on malicious links.
Use an email security tool to prevent malicious emails from getting into your team`s inboxes.
In case of a JaskaGo malware infection, an XDR solution that integrates a Next-Gen antivirus is the way to go.
Choose one of the best XDR softwares to detect and contain an incident before it damages your system.
This Cyber News was published on heimdalsecurity.com. Publication date: Wed, 20 Dec 2023 15:43:05 +0000