Unix and macOS malware

Incidents

More fakeAV for MAC. This time it’s massive

When my colleague Fabio wrote about a Rogueware campaign targeting MAC users, I investigated a bit into the origin of these campaigns. It was interesting how different researchers were getting those samples through searching images on Google. However, different searches always arrive at the same result, leading to the question: How many search terms have been poisoned?

Video

New webcast – The Truth about Malware and Linux

In this Q&A session with Ryan Naraine, Kaspersky Lab malware researcher David Jacoby dispels the myth surrounding Linux as a malware-free platform and makes the case that misconfigurations and other security problems on Linux contributes to the malware epidemic on Microsoft’s Windows operating system.

Research

Apple’s silent updates

Apple has released MacOS X 10.6.7 with several bugfixes and security-patches. This patch bundle also includes a silent update to Apple‘s built-in Xprotect anti-virus functionality.

Research

One Leopard, two Trojans

On 28th August, the latest update for MaxOS X was released – Snow Leopard. It differs in one very telling way from previous versions – for the first time in Apple’s long history, the company’s implemented an antivirus scanner.

Publications

Happy birthday, Mac!

Traditionally, malware writers have overlooked Mac in favor of targeting Windows with its bigger market share. But the proof-of-concept samples which appear periodically show that Macs aren’t invincible.

Reports

ToddyCat: your hidden email assistant. Part 1

Kaspersky experts analyze the ToddyCat APT attacks targeting corporate email. We examine the new version of TomBerBil, the TCSectorCopy and XstReader tools, and methods for stealing access tokens from Outlook.

Crypto wasted: BlueNoroff’s ghost mirage of funding and jobs

Kaspersky GReAT experts dive deep into the BlueNoroff APT’s GhostCall and GhostHire campaigns. Extensive research detailing multiple malware chains targeting macOS, including a stealer suite, fake Zoom and Microsoft Teams clients and ChatGPT-enhanced images.

Mem3nt0 mori – The Hacking Team is back!

Kaspersky researchers discovered previously unidentified commercial Dante spyware developed by Memento Labs (formerly Hacking Team) and linked it to the ForumTroll APT attacks.