Security researchers at Proofpoint have uncovered a sophisticated web inject campaign targeting MacOS users with a new information-stealing malware called FrigidStealer. The operation involves two newly identified threat actors, TA2726 and TA2727, collaborating to compromise legitimate websites and redirect victims to fake browser update pages. As organizations harden email defenses, threat actors increasingly exploit compromised websites and abused CDNs to bypass traditional security perimeters. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. North American users are funneled to TA569’s SocGholish malware, while European and Asian traffic is directed to TA2727’s payload delivery system. For Mac users, researchers at Proofpoint noted that this results in a tailored attack: Safari or Chrome users see forged update prompts that download FrigidStealer via weaponized DMG files. TA2727 coordinates payload delivery through domains like deski[.]fastcloudcdn[.]com, which serve geographically filtered scripts to Windows, Android, and Mac users. Security teams should prioritize detecting traffic to TA2726’s TDS infrastructure (blackshelter[.]org, rednosehorse[.]com) and monitor for suspicious AppleScript activity. The attack chain begins when TA2726, a traffic distribution service (TDS) operator, injects malicious JavaScript into compromised websites. Proofpoint’s Emerging Threats ruleset now includes signatures to block these domains, while endpoint solutions must scrutinize ad-hoc signed binaries claiming to be browser updaters. Tushar is a Cyber security content editor with a passion for creating captivating and informative content. Regular patching, user education about fake updates, and restricting unsigned application executions remain critical defenses against these evolving threats. The malware employs advanced social engineering tactics, using WailsIO frameworks to render browser-like interfaces that mimic legitimate installers. Victims receive instructions to right-click and “Open” the malicious application, bypassing macOS Gatekeeper protections.
This Cyber News was published on cybersecuritynews.com. Publication date: Wed, 19 Feb 2025 20:35:07 +0000