Atomic macOS Stealer Malware Can Steal Keychain Info, Files, Browser Wallets and More

[szw-mapple fan]

Except Apple allows crapware onto their Mac App store too

PSA: Watch Out for Fake ChatGPT Apps and Other Scams in the Mac App Store

There have long been complaints from developers and App Store users about apps that offer limited functionality and charge high prices in an effort...

www.macrumors.com

not to mention all the junk on their iOS App store

Yea these apps are junk but not security risks. And unless OpenAI accuses them of otherwise, these apps are legitimate apps using the charGPT API, which is not breaking any of the App Store’s rules.

 

[Unregistered 4U]

And how devastating has that flexility been for the majority of Mac people?

It doesn’t HAVE to be devastating for the majority for it to have a serious and real impact for those that are affected. There are billions of dollars worth of scams NOT happening on iOS devices now that WILL be happening on iOS devices in the future. That’s not even a question, unless there are those that think that malicious actors will specifically NOT target iOS users.

#MoreMalwareForiOS!

Yes, there are cases but relatively few and far between. The App Store is not immune either- occasionally a nefarious app gets through and affects users who downloaded that app. Windows runs on far more computers and has far more viruses/trojans/malware (and far more bad guys trying their best to do this kind of thing there) and yet there are not really that many cases where someone's life is destroyed even in that Windows world due to this sort of thing.

In 2015, the economic cost of cybercrime was $3 trillion worldwide.

The Emerging Era of Cyber Defense and Cybercrime | Microsoft Security Blog

Cyber threats are everywhere, from hackers causing mischief to show off their skills to organized crime syndicates employing sophisticated financial ruses against governmental organizations, businesses, social channels and individuals. Seventy-one percent of companies admit they fell victim to a...

www.microsoft.com

Two guesses on whether or not this number has decreased or increased. And I’ll even give you a freebie and say it’s not “decreased”.

Someone needs to speak for the companies that could drive that number even HIGHER if given the chance to be deployed to more Apple devices!

 

[lkrupp]

"A .dmg file is used to get the malware on a victim's machine, and once installed, it immediately begins accessing sensitive information and sending it to a remote server."

Stupid is as stupid does. As usual the user has to allow this to be installed, it doesn’t install itself. Also remember there has always been a Safari option to “Open safe files after downloading” Make damn sure you never turn that option on.

 

[HobeSoundDarryl]

It doesn’t HAVE to be devastating for the majority for it to have a serious and real impact for those that are affected. There are billions of dollars worth of scams NOT happening on iOS devices now that WILL be happening on iOS devices in the future. That’s not even a question, unless there are those that think that malicious actors will specifically NOT target iOS users.

#MoreMalwareForiOS!

I agree that opening it up to other sellers will increase the opportunity for more malware installations. Anyone overly concerned about this can keep getting their apps from the one and only source where they feel secure.

Capitalism works for consumers if there is competition. Where there is no competition, there is exploitation. Competition is good... even for those afraid to buy anywhere else. Competitive pricing may make Apple compete in their own store pricing, which can then deliver the perceived security AND better pricing for those who will only shop there. If not, people who will only buy from Apple will simply be paying up for that sense of added security. Good for all to make whatever decision makes the most sense (and cents) for themselves.

 

[Marshall73]

Most apps I want to side load are open source emulators and I can compile them myself

You can do this already with Xcode.

 

[HobeSoundDarryl]

It doesn’t HAVE to be devastating for the majority for it to have a serious and real impact for those that are affected. There are billions of dollars worth of scams NOT happening on iOS devices now that WILL be happening on iOS devices in the future. That’s not even a question, unless there are those that think that malicious actors will specifically NOT target iOS users.

#MoreMalwareForiOS!


In 2015, the economic cost of cybercrime was $3 trillion worldwide.

The Emerging Era of Cyber Defense and Cybercrime | Microsoft Security Blog

Cyber threats are everywhere, from hackers causing mischief to show off their skills to organized crime syndicates employing sophisticated financial ruses against governmental organizations, businesses, social channels and individuals. Seventy-one percent of companies admit they fell victim to a...

www.microsoft.com

Two guesses on whether or not this number has decreased or increased. And I’ll even give you a freebie and say it’s not “decreased”.

Someone needs to speak for the companies that could drive that number even HIGHER if given the chance to be deployed to more Apple devices!

Now where's the study on the economic cost of having only a single seller of anything for many years vs. savings of competition?

Look, there's been hundreds(?) of threads about this already- no need to rehash it again. I live in a capitalistic society. Capitalism works for consumers by competitors working costs of goods & services down. Where there is no competition, there is exploitation. That is how it has always been and will always be.

We can saint Apple Inc in our heads if we want but no "saint" before them who had an exclusive lock on the sale of anything seemed to resist the temptation to exploit their lock. And they will say and do anything to persist that lock... and seed every possible tale of woe & destruction should any force risk breaking that lock. That's how it always goes.

We could freshly debate in this thread and a hundred threads to come that bring this topic up again. But the train is on the way to the station. GOVs have decided to force the issue. We will get to see if the people with the power to get their apps from other sources suffer death & devastation soon enough.

Those of us with Macs should already know the outcome because it's never been different than that for us. But we can believe whatever we want. It won't stop it from happening now that GOVs are on it... anymore than there won't be iPhones still clinging to Lightning. It is inevitable. I don't recall any line in Revelations describing this as a catalyst of end times. I suspect we'll all be just fine.

 

[ss2cire]

Is the seller going to get arrested ? I hope he does.

Who said they are a he? What they are a she?

 

[andrewxgx]

1. if this app is signed with legitimate apple developer certificate, apple can revoke it like instantly and make this unusable
2. if this aint signed with a dev certificate, its quite hard to run unsigned software on macOS so you have to be an absolute imbecyle to somehow start this piece of crap

 

[Realityck]

No, how long have Macs been around? And how long have Mac users been able to get their apps from any source? And how devastating has that flexility been for the majority of Mac people?

I can't help noticing that most malware like this comes across as so dumb as to be the equivalent of MouseHunt for people that don't educate themselves on how to just avoid malware being installed accidentally.

 

[les_is_more]

What’s interesting to me is that it claims to be able to steal the user’s password. This should not be possible. When your password is entered it’s compared to the encrypted version, but they should not be able to take the encrypted version and turn it into plain text. I know that’s how it works on Unix and Windows. How is this possible?

Quick Edit: Unless they’re just tricking the user into entering it with a fake elevation prompt, of course.

The article talked about that the malware is in a dmg form and fake a system prompt that asks user to enter their Mac password

 

[CarAnalogy]

The article talked about that the malware is in a dmg form and fake a system prompt that asks user to enter their Mac password

Interesting that Apple mocked Microsoft all those years ago about UAC, but actually the tables have turned. Apple asks for your user password kind of a lot. Something like UAC would actually help prevent what is essentially a phishing attack. If you could elevate an administrator by just confirming a prompt people wouldn’t be so used to entering their password all the time and potentially exposing it.

I know at the time UAC was a lot more chatty but now it really only shows up when installing, updating, or removing programs. Just like on the Mac.

 

[Solomani]

The article mentions the social media app Telegram. That right there tells you a lot. Telegram originates in Russia.

But even after the Russian founders of Telegram left Russia, they still run a seedy underground operation. They won't even disclose their official HQ or the location of their corporate offices.

Per Wikipedia:

Telegram is registered as a company in the British Virgin Islands[9] and as an LLC in Dubai.[39][40] It does not disclose where it rents offices or which legal entities it uses to rent them.

Kinda like when you read about an online transaction gone wrong.... and the first line mentions "Craigslist". In most cases you know you are reading about a very sad and dishonest scam.

 

[I7guy]

Except Apple allows crapware onto their Mac App store too

PSA: Watch Out for Fake ChatGPT Apps and Other Scams in the Mac App Store

There have long been complaints from developers and App Store users about apps that offer limited functionality and charge high prices in an effort...

www.macrumors.com

not to mention all the junk on their iOS App store

Agreed. Because apples store is crap let’s throw the baby out with the bath water and shortcut this entire sideloading process!and third party app stores /s

 

[genovelle]

Sounds like a great reason to only install from the App Store.

And to avoid chrome.

 

[Analog Kid]

Even malware is on a subscription model these days

Some malware is subscription, but all subscriptions are malware.

 

[golfnut1982]

Even malware is on a subscription model these days

Good one.

 

[Stella]

Sounds like a great reason to only install from the App Store.

Not at all. Apply a bit of thought before running unknown applications.

Almost all the applications I rely upon aren't in the AppStore - and neither can be due to restrictions.

 

[Love-hate 🍏 relationship]

I only rely on Apple’s own Apple App Store on Mac. 💻

u dont install ANY software from github ??

 

[Love-hate 🍏 relationship]

Is now a good time to talk about that hilarious thing that Apple calls macOS firewall?

If you are running macOS you should really be running Lulu or something similar.

(this matters because you will be prompted about outgoing connection attempt)

can you tell us more about it please ?

 

[JosephAW]

This should be a reminder to do your backups now and then keep them offline.

 

[Love-hate 🍏 relationship]

I think malware is legal. They are offered for educational and research purposes only. It's up to the user to use it for good or bad.

not when u make a business out of it, i don't believe it is

 

[Love-hate 🍏 relationship]

This is the future for iOS once sideloading comes, and many iOS users will not be ready. Not taking a side about sideloading here. Just saying this will happen. Apple needs to step up even more on security for iOS.

And maybe provide much more education? Right now Apple itself provides also no education on proper user habits when it comes to protecting themselves.

no it's not . admin permissions are not the same on macOS and IOS, like , at all

 

[Howyalikdemapls]

What’s interesting to me is that it claims to be able to steal the user’s password. This should not be possible. When your password is entered it’s compared to the encrypted version, but they should not be able to take the encrypted version and turn it into plain text. I know that’s how it works on Unix and Windows. How is this possible?

Quick Edit: Unless they’re just tricking the user into entering it with a fake elevation prompt, of course.

Ya, I think it’s the a fake prompt.

From the article “A fake system prompt is presented to get access to the system password, and it asks for access to files in the documents and desktop folders.”

 

[Love-hate 🍏 relationship]

i

No, how long have Macs been around? And how long have Mac users been able to get their apps from any source? And how devastating has that flexility been for the majority of Mac people?

Yes, there are cases but relatively few and far between. The App Store is not immune either- occasionally a nefarious app gets through and affects users who downloaded that app. Windows runs on far more computers and has far more viruses/trojans/malware (and far more bad guys trying their best to do this kind of thing there) and yet there are not really that many cases where someone's life is destroyed even in that Windows world due to this sort of thing.

We don't need "security" to scare the masses into embracing a monopoly scenario of buying from one and only one source. No consumer wins when all competition for their business is reduced down to a single seller. I cannot recall any situation in all of history where a single seller does not exploit their exclusive position... until competition shows up and drives down pricing for the same products or services.

Consumers simply need to be smart and make good decisions about who they trust. Will even the smart ones get that wrong sometimes? YES. Does even Apple let a bad app in the App store sometimes? YES.

But no need to cede competitive marketplaces to single sellers out of this type of fear. Anyone that afraid can already embrace getting their apps from the divine, one and only. Everyone else should prefer to hang on to the great power of consumer flexility to shop around and choose for themselves vs. trust one- and only one- seller. There is no consumer win in that scenario... only an illusion of one... much like the illusion that the whole world will be destroyed once people can choose to get apps for their iDevices from sources other than Apple. We've had periods where that has been possible too (jailbreaking) and there was never any story where all who dared buy elsewhere suffered devastation, fire & brimstone.

Again, anyone too afraid to shop from other stores, won't have to do so. They can maintain their illusion of security by continuing to buy from only Apple. However, others may prefer some genuine Capitalism competition, the concept of more of the money we pay potentially reaching those who create what we buy, AND the flexibility to have apps that Apple refuses to allow for any old reason (not always an actual good reason).

IMO: just as we are with Mac apps, we will be better off when there is more than one seller of iDevice apps. And just as we experience with our Macs, the odds in the impending doom & destruction spun by that potential seems farrrrrrrrr overblown. We already know this because our Macs are loaded with the same keychain, the same private information, etc. We simply pretend that it will be different with iDevices for some reason. Why? Mostly because Apple says so. Why? Because there is a LOT of easy revenue in Apple's cut of every single sale in the one and only iDevice store. No exclusive seller of anything EVER wants competition... and will say & do ANYTHING to try to maintain their lock on that easy money.

it's not even that, it's just the fact that this relies on admin permissions on macOS, and once you give it access it can do a lot of things , since this is a desktop environemment

ios and android malware are way way less powerful, due to how limited those systems are. at best, they could be able to show you ads or some ********, but certaintely not steal that amount of data

 

[Love-hate 🍏 relationship]

Ya, I think it’s the a fake prompt.

From the article “A fake system prompt is presented to get access to the system password, and it asks for access to files in the documents and desktop folders.”

it's definitely a fake prompt! you can see it on the pic, it looks so freaking fake, i wonder why they didnt spend more time making it more realistic