Trojan-Proxy Threat Expands Across macOS, Android and Windows

Security researchers have identified a new threat involving cracked applications distributed by unauthorized websites, concealing a Trojan-Proxy designed to compromise victims' devices.
Cybercriminals have been taking advantage of users seeking free software tools, exploiting their willingness to download from questionable sources, and ultimately exposing them to malware installations.
According to a new advisory published by Kaspersky today, the infected applications, presented as.
PKG installers on macOS, differ from the original, unaltered versions usually distributed as disk images.
These installers run scripts before and after installation, enabling the attackers to execute malicious code post-installation.
The malware script, found in the /Contents/Resources/ directory, replaces critical files such as WindowServer and p.plist in the victim's system.
This grants attackers administrator permissions and allows the malware to operate undetected.
The p.plist file acts as a configuration file, mimicking a Google configuration file to auto-start the WindowServer file as a system process after the operating system loads.
The WindowServer universal format binary file is used to bypass detection by security measures.
Once initiated, it creates log files and attempts to obtain a command-and-control server IP address through DNS-over-HTTPS, concealing its communication in regular HTTPS traffic.
Despite multiple versions of the Trojan being discovered, anti-malware vendors have not flagged any as malicious.
The Trojan connects with the C2 server via WebSocket, awaiting commands.
Beyond macOS, researchers uncovered Trojan variations targeting Android and Windows platforms, all connecting to the same C2 server.
The advisory also contains a list of Indicators of Compromise for various samples.


This Cyber News was published on www.infosecurity-magazine.com. Publication date: Wed, 06 Dec 2023 16:30:23 +0000


Cyber News related to Trojan-Proxy Threat Expands Across macOS, Android and Windows

Pirated Software Puts Mac Users at Risk as Proxy Malware Emerges - Malware is being targeted at Mac users who receive pirated versions of popular apps from warez websites after they choose to download them from those websites. Various reports state that cybercriminals are infecting macOS devices with proxy trojans ...
10 months ago Cysecurity.news
TeamCity Intrusion Saga: APT29 Suspected Among the Attackers Exploiting CVE-2023-42793 - As part of this analysis, we look at threat actor TTPs employed throughout the intrusion and how they were identified and pieced together by the FortiGuard IR team. The following section of this report focuses on the activities of one of these threat ...
10 months ago Feeds.fortinet.com
9 Best DDoS Protection Service Providers for 2024 - eSecurity Planet content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More. One of the most powerful defenses an organization can employ against distributed ...
10 months ago Esecurityplanet.com
Staying ahead of threat actors in the age of AI - At the same time, it is also important for us to understand how AI can be potentially misused in the hands of threat actors. In collaboration with OpenAI, today we are publishing research on emerging threats in the age of AI, focusing on identified ...
7 months ago Microsoft.com
Top 7 Cyber Threat Hunting Tools for 2024 - Cyber threat hunting is a proactive security measure taken to detect and neutralize potential threats on a network before they cause significant damage. To seek out this type of threat, security professionals use cyber threat-hunting tools. With ...
8 months ago Techrepublic.com
Cracked macOS Software Laced with New Trojan Proxy Malware - Kaspersky recently uncovered the most recent Trojan Proxy malware campaign, revealing that the earliest submission of the payload on VirusTotal can be traced back to April 28, 2023. According to the latest research from cybersecurity researchers at ...
10 months ago Hackread.com
New proxy malware targets Mac users through pirated software - Cybercriminals are targeting Mac users with a new proxy trojan malware bundled with popular, copyrighted macOS software being offered on warez sites. Proxy trojan malware infects computers, turning them into traffic-forwarding terminals used to ...
10 months ago Bleepingcomputer.com
VB.NET Proxy and VPN Check with IP2Location.io - Virtual Private Network servers are proxy servers that people use daily when browsing the Internet. As most of us are aware, websites track their visitors for advertising and marketing purposes. That's the same reason that people use residential ...
9 months ago Feeds.dzone.com
Enabling Threat-Informed Cybersecurity: Evolving CISA's Approach to Cyber Threat Information Sharing - One of CISA's most important and enduring roles is providing timely and actionable cybersecurity information to our partners across the country. Nearly a decade ago, CISA stood up our Automated Indicator Sharing, or AIS, program to widely exchange ...
9 months ago Cisa.gov
What Is Cyber Threat Hunting? - Cyber threat hunting involves proactively searching for threats on an organization's network that are unknown to traditional cybersecurity solutions. A recent report from Armis found that cyber attack attempts increased by 104% in 2023, underscoring ...
8 months ago Techrepublic.com
What Is Threat Modeling? - Threat modeling emerges as a pivotal process in this landscape, offering a structured approach to identify, assess, and address potential security threats. Threat Modeling Adoption and Implementation The successful adoption of threat modeling within ...
8 months ago Feeds.dzone.com
Proxy Trojan Targets macOS Users for Traffic Redirection - A sophisticated proxy Trojan targeting macOS has been discovered and is being distributed through pirated versions of genuine business software, including editing tools, data recovery software, and network scanning applications. The Trojan operates ...
10 months ago Darkreading.com
How to Use Threat Intelligence Feeds for SOC/DFIR Teams - Threat intelligence feeds provide real-time updates on indicators of compromise, such as malicious IPs and URLs. Security systems can then ingest these IOCs to identify and block potential threats, which essentially grants organizations immunity to ...
4 months ago Cybersecuritynews.com
Socks5Systemz proxy service infects 10,000 systems worldwide - A proxy botnet called 'Socks5Systemz' has been infecting computers worldwide via the 'PrivateLoader' and 'Amadey' malware loaders, currently counting 10,000 infected devices. The malware infects computers and turns them into traffic-forwarding ...
10 months ago Bleepingcomputer.com
CVE-2024-37891 - urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with `ProxyManager`, the `Proxy-Authorization` header is only sent to the configured proxy, as expected. However, when sending HTTP requests *without* ...
3 months ago
Trojan-Proxy Threat Expands Across macOS, Android and Windows - Security researchers have identified a new threat involving cracked applications distributed by unauthorized websites, concealing a Trojan-Proxy designed to compromise victims' devices. Cybercriminals have been taking advantage of users seeking free ...
10 months ago Infosecurity-magazine.com
How to Overcome the Most Common Challenges with Threat Intelligence - Today's typical approach to threat intelligence isn't putting organizations in a place to do that. Instead, many threat intelligence tools are delivering too much uncurated and irrelevant information that arrives too late to act upon. Organizations ...
9 months ago Cyberdefensemagazine.com
Android malware and unwanted software statistics for Q1 2024 - Over 389,000 malicious installation packages were detected, of which: 11,729 packages were related to mobile banking Trojans, 1,990 packages were mobile ransomware Trojans. The rapid growth in the total number of attacks between Q2 and Q4 2023 is ...
4 months ago Securelist.com
Buzzing on Christmas Eve: Trigona Ransomware in 3 Hours - In late December 2022, we observed threat actors exploiting a publicly exposed Remote Desktop Protocol host, leading to data exfiltration and the deployment of Trigona ransomware. On Christmas Eve, within just three hours of gaining initial access, ...
8 months ago Thedfirreport.com
Windows Incident Response: Human Behavior In Digital Forensics, pt III - Digital forensics can provide us insight into a threat actor's sophistication and situational awareness, which can, in turn, help us understand their intent. Observing the threat actor's actions helps us understand not just their intent, but what ...
9 months ago Windowsir.blogspot.com
New Tool Set Found Used Against Organizations in the Middle East, Africa and the US - Unit 42 researchers observed a series of apparently related attacks against organizations in the Middle East, Africa and the U.S. We will discuss a set of tools used in the course of the attacks that reveal clues about the threat actors' activity. We ...
10 months ago Unit42.paloaltonetworks.com
How to secure on-prem apps with Entra Application Proxy - If your internal web applications are still internet-facing, then it's time to move away from turning your firewall into Swiss cheese just to externalize apps for your users. To reduce the attack surface, a traditional method, such as a VPN, has its ...
7 months ago Techtarget.com
Windows 10 Extended Security Updates Promised for Small Businesses and Home Users - Already common for enterprises, for the first time, individuals will also get the option to pay for extended security updates for a Windows operating system that's out of support. Windows 10 will stop getting free updates, including security fixes, ...
10 months ago Techrepublic.com
eSentire Threat Intelligence reduces false positive alerts - eSentire launched its first standalone cybersecurity product, eSentire Threat Intelligence, extending eSentire's protection and automated blocking capability across firewalls, threat intelligence platforms, email services and endpoint agents. ...
6 months ago Helpnetsecurity.com
Lets Open(Dir) Some Presents: An Analysis of a Persistent Actor's Activity - By analyzing tools, logs and artifacts left open to the internet, we were able to profile the threat actor and their victims. After analyzing the artifacts we can conclude with moderate confidence that the majority of the threat actor activity ...
9 months ago Thedfirreport.com

Latest Cyber News


Cyber Trends (last 7 days)


Trending Cyber News (last 7 days)