Big Mac virus on YouTube be aware !!

[DCIFRTHS]

This has nothing to do with open-source apps. Little Snitch has never been open-source or available on GitHub, but frequently fake pages appear that offer to install it for free and it’s obviously malware.

I haven't used Little Snitch for years. Anyone have the URL for Objective Development? I searched, but want to be sure I don't have fake URL.

If you know the correct URL for Carbon Copy Cloner, please post that too. I know someone verified it for me, but I don't remember the thread. Yes, probably age related... lol

Thanks!

 

[bogdanw]

I haven't used Little Snitch for years. Anyone have the URL for Objective Development? I searched, but want to be sure I don't have fake URL.

If you know the correct URL for Carbon Copy Cloner, please post that too. I know someone verified it for me, but I don't remember the thread. Yes, probably age related... lol

Thanks!

Objective Development https://obdev.at/index.html
Carbon Copy Cloner https://bombich.com

You can check links on
https://www.virustotal.com/gui/url/
Objective Development
https://www.virustotal.com/gui/url/d8dfae7e6448bd343b9e7e7fd9ed3a6aaa883b57fa6412f32a9de68d74617bc3
Carbon Copy Cloner
https://www.virustotal.com/gui/url/002cc384c182797029d6a63ff0749d5849bd7d052b798fe60bc844dc1496bda8

 

[DCIFRTHS]

Objective Development https://obdev.at/index.html
Carbon Copy Cloner https://bombich.com

You can check links on
https://www.virustotal.com/gui/url/
Objective Development
https://www.virustotal.com/gui/url/d8dfae7e6448bd343b9e7e7fd9ed3a6aaa883b57fa6412f32a9de68d74617bc3
Carbon Copy Cloner
https://www.virustotal.com/gui/url/002cc384c182797029d6a63ff0749d5849bd7d052b798fe60bc844dc1496bda8

Thank you.

 

[Alameda]

I just saw a YouTube video talking about how ads are doing this all over the place.

You'd think YouTube would prevent such ads, but they're getting paid, so who cares if you get hurt, right?

 

[blufrog]

Compromised legitimate software is getting to be a problem, too. Recently FileZilla and a couple of other apps were compromised by offering links off the legitimate page to a compromised binary package.

YouTube is terrible for ads for fake software and other illegal crap. I'm really surprised (not really) that the likes of Google/YouTube and others haven't been brought to task over these ads already.

 

[bogdanw]

"SHub Reaper | macOS Stealer Spoofs Apple, Google, and Microsoft in a Single Attack Chain"
https://www.sentinelone.com/blog/sh...oogle-and-microsoft-in-a-single-attack-chain/
"SentinelOne observed a new SHub variant using the build tag “Reaper”.
Reaper uses fake WeChat and Miro installers as lures, but what stands out is the way the infection chain shifts its disguise at each stage. The payload may be hosted on a typo-squatted Microsoft domain, executed under the guise of an Apple security update, and persist from a fake Google Software Update directory. Alongside the previously documented SHub feature set, the build also adds an AMOS-style document theft module with chunked uploads."

 

[iHorseHead]

Yes it can be very dangerous, imagine you want to download an app that you know, you click on a fake website, download the app and boom you got hacked... Google should really verify ads !

Also, be careful on Meta and Instagram and Facebook etc.
Many fake ads and scams. Google should indeed verify ads.

 

[bogdanw]

"Hackers abuse Google ads, Claude.ai chats to push Mac malware"
https://www.bleepingcomputer.com/ne...oogle-ads-claudeai-chats-to-push-mac-malware/
"Attackers are abusing Google Ads and legitimate Claude.ai shared chats in an active malvertising campaign.
Users searching for "Claude mac download" may come across sponsored search results that list claude.ai as the target website, but lead to instructions that install malware on their Mac."

 

[turbineseaplane]

"Hackers abuse Google ads, Claude.ai chats to push Mac malware"
https://www.bleepingcomputer.com/ne...oogle-ads-claudeai-chats-to-push-mac-malware/
"Attackers are abusing Google Ads and legitimate Claude.ai shared chats in an active malvertising campaign.
Users searching for "Claude mac download" may come across sponsored search results that list claude.ai as the target website, but lead to instructions that install malware on their Mac."

Hmm.

Folks searching for AI software end up installing malware after clicking on Google ADs and following instructions to install the malware.

I mean. At some point, this is a users fault.

 

[bogdanw]

following instructions to install the malware.

The instructions are persuasive (Apple Support mentioned) and might seem real to an inexperienced user

 

[turbineseaplane]

The instructions are persuasive (Apple Support mentioned) and might seem real to an inexperienced user

My rule is:

Don't be following instructions to use Terminal commands unless you KNOW what you're doing.

Additionally, life is not without risk.
People are constantly also getting bilked by scam Apps and/or systems that are IN the Apple App Stores.

 

[T'hain Esh Kelch]

BIG MAC VIRUS ON YOUTUBE BE AWARE !!​

not a virus

but if you [insert an array of majorly stupid steps that would only fool your grandmother]

Macrumors is not what it used to be. 😛

 

[Astuces iOS]

My rule is:

Don't be following instructions to use Terminal commands unless you KNOW what you're doing.

Additionally, life is not without risk.
People are constantly also getting bilked by scam Apps and/or systems that are IN the Apple App Stores.

Hmm lol this post is back on, hmm yeah if I have something to say, be aware to whatever you open and run on your mac ! Apple isn’t wrong to force dev to pay the apple dev subscription !

 

[bogdanw]

Apple isn’t wrong to force dev to pay the apple dev subscription !

Malware developers can afford to pay the subscription.
2020 "Apple notarizes dozens of Mac malware samples" https://www.intego.com/mac-security-blog/apple-notarizes-dozens-of-mac-malware-samples/
2023 "Apple notarized a North Korean trojan for macOS"
https://forums.macrumors.com/thread...ized-a-north-korean-trojan-for-macos.2385323/

 

[Astuces iOS]

Malware developers can afford to pay the subscription.
2020 "Apple notarizes dozens of Mac malware samples" https://www.intego.com/mac-security-blog/apple-notarizes-dozens-of-mac-malware-samples/
2023 "Apple notarized a North Korean trojan for macOS"
https://forums.macrumors.com/thread...ized-a-north-korean-trojan-for-macos.2385323/

Ik but at least it reduce the malwares

 

[bogdanw]

Ik but at least it reduce the malwares

It doesn’t reduce anything.

Most macOS malware relies on social engineering, that is convincing users to install it. It doesn’t have to be signed or notarised.

Apple took a small step to prevent ClickFix (copy-paste malware-installing commands in Terminal) and it was bypassed within two weeks https://forums.macrumors.com/thread...e-for-terminal-commands.2479927/post-34532981

More sophisticated attacks, can use stolen credit card details to register a developer account and successfully get their malware notarized.

 

[bogdanw]

CrashStealer - malware notarized by Apple.
"CrashStealer: C++ macOS infostealer posing as crash reporter"
https://www.jamf.com/blog/crashstealer-macos-infostealer-analysis/
'a C++ macOS infostealer that impersonates Apple's crash-reporting framework to harvest browser credentials, cryptocurrency wallets and keychain data"

 

[turbineseaplane]

CrashStealer - malware notarized by Apple.

I keep reading this over and over again and getting a bit sadder.

 

[CrabQueenInc]

I keep reading this over and over again and getting a bit sadder.

Apple’s application review and its app stores are a mess.

 

[M.Brane]

This is why we don't do everyday computing under an Admin account.

 

[bogdanw]

This is why we don't do everyday computing under an Admin account.

That's irrelevant. The malware steals information from the user account, admin or not.

 

[bogdanw]

"ClickLock Stealer: Paste Once, Lose Everything"
https://www.group-ib.com/blog/clicklock-stealer-macos-malware/
"It is also worth noting that the current malware doesn’t even need any elevated privileges or rely on exploits for the successful execution."

 

[M.Brane]

You still have to install it for it to work.

 

[SmOgER]

😅 yeah tho there is something to clarify, so when you open the dmg there is a terminal icon instead of app… then when you drag it’s too late… there is something who ask for your password and will not get off until you enter it…

At this point do you restart your mac? It’s a risk because you could run the virus (because of launch elements)… So yeah the case is a bit tricky here…

It’s sad for those getting hacked cause everything seams normal (the hackers literally copy content OF THE REAL APP) and then oops wrong drag and drop…

You simply exit with ctrl-c or force-close terminal. This may not prevent ALL of the damage depending on how that malware was coded, but it would prevent MOST of it since now there's no way for it to run anything with admin rights. If you simply do this and then do not input your password for any potentially strange dialogs asking for root on startup, then this shouldn't be hard to get rid of promptly.

"Hacking” is really doing heavy lifting here. There're no exploits or actual hacking to speak of, you are simply getting tricked into installing it yourself manually and granting everything it needs.