Newly discovered cracked applications being distributed by unauthorized websites are delivering Trojan-Proxy malware to macOS users who are looking for free or cheap versions of the software tools they want.
The malware can be used by bad actors for a range of malicious activities, including hacking into systems or running phishing campaigns.
The cross-platform malware - versions include elements for Windows and Android - is the latest in ongoing efforts by threat groups to target macOS users through cracked applications downloaded from such unauthorized websites.
He noted that original - and unaltered - applications are normally distributed as a disk image.
The script code with the Trojan-Proxy malware contains two suspicious files - WindowsServer and p.plist - that come along the cracked application resources.
The script replaces two legitimate files with those two from the resources folder and grants administrator permissions to the suspicious files.
The malware is made to appear as WindowServer, a universal format binary file, to hide its presence, which seemed to work.
Kaspersky researchers found several versions of the application, including the earlier one uploaded to VirusTotal on April 28.
None of the versions were tagged as malicious by cybersecurity vendors, Puzan wrote.
After the trojan starts, it creates a log file and tries to gete a command-and-control server IP address through DNS-over-HTTPS, which makes the DNS request look like a regular HTTPS request, which keeps it hidden from traffic monitoring tools.
Once it gets a response, the malware creates a connection with the C2 server via WebSocket by sending the application version and awaiting a command with a message.
Using DoH and WebSockets indicates that sophisticated hackers want to avoid network-based detection tools that enterprises deploy, according to Lionel Litty, chief security architect at Menlo Security.
Along with application targeting macOS, Kasperky also discovered similar Trojan-Proxies that hide in cracked software for Android and Windows that connected to the same C2 server, Puzan wrote.
There a number ways to address the threat, with the top one being not downloading software from unauthorized sources.
This Cyber News was published on securityboulevard.com. Publication date: Fri, 08 Dec 2023 16:43:08 +0000