Common Windows Malware Can Now Infect Macs

[MacRumors]

A common form of malware on Windows systems has been modified into a new strain called "XLoader" that can also target macOS (via Bleeping Computer).

Derived from the Formbook info-stealer for Windows, XLoader is a form of cross-platform malware advertised as a botnet with no dependencies. It is used to steal login credentials, capture screenshots, log keystrokes, and execute malicious files. The malware was discovered by security researchers at Check Point Software.

A server hosting the macOS version of XLoader is available to bad actors on the dark web for $49 per month. Check Point tracked XLoader for a six-month period, seeing requests from 69 countries, indicating significant use across the world. More than half of all victims were based in the United States.

Formbook continues to be a prevalent threat, being part of over 1,000 malware campaigns in the last three years, and XLoader is expected to have even wider use given its cross-platform capability and greater level of sophistication.

Head of Cyber Research at Check Point, Yaniv Balmas, said that macOS's growing popularity has exposed it to increasing attention from cybercriminals, who see the platform as a worthwhile target.

While there might be a gap between Windows and macOS malware, the gap is slowly closing over time. The truth is that macOS malware is becoming bigger and more dangerous.

According to Check Point, XLoader is stealthy enough for it to remain hidden to most users. It is possible to check for its presence by using macOS's Autorun to check the username in the OS and look into the LaunchAgents folder, where entries with suspicious filenames should be deleted.

Article Link: Common Windows Malware Can Now Infect Macs

 

[alexandr]

innovation at its best.

 

[Blackstick]

So XProtect gets new definitions and this becomes a non-issue...

 

[macintoshmac]

"Oh, Sh*t!"

 

[TheYayAreaLiving 🎗️]

No matter what these Mac’s are protected. Let’s be real here.

When was the last time you encountered your Mac got a virus?

 

[npmacuser5]

How does one get this malware? Important to know one has it but how did one get it just as important.

 

[ikir]

macOS is much more secure but users often doesn't have a clue. Macs can install software other than App Store and you like it or not, this is the main cause of malware diffusion. Cheap users want to download movies and software without paying = they get infected.

 

[Sciomar]

No matter what these Mac’s are protected. Let’s be real here.

I know we should all know this but for everyone in the room, Mac's have always been able to get a virus. They were such a small subset of the computing world the payoff wasn't huge. Things have changed with the more mainstream adoption of Macs and now it's open season for the bad guys.

 

[SamRyouji]

Definitely not surprising, seeing the more widespread adoption of Macs everywhere. It's the law of nature: the more famous you are, the bugger the threats.
.
Craig is right, after all: the openness of macOS left it more vulnerable.

 

[Wildkraut]

Ohh let me call it out for you "LOCK MACOS DOWN, LOCK IT DOWN, NOW!", and allow MacAppStore installs only!
/s

 

[urgs]

Would be nice if someone could provide a list of all C&C servers used by xLoader.
I had only found a few, but it’s said there were approximately 1300 of them.

 

[SamRyouji]

Ohh let me call it out for you "LOCK MACOS DOWN, LOCK IT DOWN, NOW!", and allow MacAppStore installs only!
/s

Well...certainly Apple has been considering that since the launch of Mac App Store up until this very day. Why they haven't done the lockdown is just because of the controversy ot will create if they do just that. ?

 

[bingeciren]

I know we should all know this but for everyone in the room, Mac's have always been able to get a virus.

Malware yes, virus for macOS? Not that I'm aware of. Can you name some?

 

[Cubsfan]

Infection path would be good information.

Also, I generally find LittleSnitch to be a great defense against this kind of thing (as long as the virus doesn't disable it). It may still exist, but you can identify it by network access.

 

[Martyimac]

Malware yes, virus for macOS? Not that I'm aware of. Can you name some?

And there are viruses listed

All the Mac malware we know about

Wondering how many viruses exist for the Mac? Here is a list recent Mac malware attacks, viruses for Apple computers, and security threats that Mac users have suffered

www.macworld.co.uk

 

[skitidetdu]

It is possible to check for its presence by using macOS's Autorun to check the username in the OS and look into the LaunchAgents folder, where entries with suspicious filenames should be deleted.

Can somebody explain what this means?

Edit: found a LaunchAgents folder in the library. Don't understand what AutoRun is

 

[The Clark]

I'm not too worried to be honest.

I know that if the alcoholics at Windows can do a decent job securing their OS (windows defender) then MacOS will be fine too.

 

[ikir]

Ohh let me call it out for you "LOCK MACOS DOWN, LOCK IT DOWN, NOW!", and allow MacAppStore installs only!
/s

Which is true since iPad and iPhone are more protected even if they are more popular.

 

[velocityg4]

Well people complain that software devs ignore the Mac too often. This way you don't have to use Bootcamp or Parallels to experience the malware out there. Are they making these as universal binaries? So that M1 users can run optimized versions.

They should also make sure they make them work with WINE. So, Linux users don't feel left out.

 

[apparatchik]

What does botnet with no dependencies mean, does this also affect Linux, et al?

 

[Spock]

Ohh let me call it out for you "LOCK MACOS DOWN, LOCK IT DOWN, NOW!", and allow MacAppStore installs only!
/s

And that will most likely be when I stop using the Mac. I am ok with the restrictions on the iPhone and even the iPad but leave my Mac alone.

 

[B4U]

That finder icon is really creepy..
Can we do something about that please?

 

[Mr. Dee]

I wish they could be a little bit more clarity on how to really check for this. Interesting how things have come full circle. I remember years ago reading Total Panther from Macworld and guest columnist David Pogue was bragging about Mac OS X being a better choice than Windows and the upcoming 'Longhorn' because its a smaller user base and hackers are not interested. It was so naive to think that hackers would ignore macOS because its a smaller user base.

These changes to the security landscape will only force Apples hand to potentially lock down macOS, iOS style. It wouldn't be a bad idea for the vast majority of users. Just have a special easy to enable mode for power users who know what they are doing. But for grand ma, Cindy and Todd who just want email, spotify and download apps from the App Store, it shouldn't be a big deal.

 

[knappeduivel]

And there are viruses listed

All the Mac malware we know about

Wondering how many viruses exist for the Mac? Here is a list recent Mac malware attacks, viruses for Apple computers, and security threats that Mac users have suffered

www.macworld.co.uk

All malware except some Microsoft macro's

 

[urgs]

Infection path would be good information.

Also, I generally find LittleSnitch to be a great defense against this kind of thing (as long as the virus doesn't disable it). It may still exist, but you can identify it by network access.

Can somebody explain what this means?

Edit: found a LaunchAgents folder in the library. Don't understand what AutoRun isFound something at 9to5mac

Found something at 9to5mac

1. Go to /Users/[username]/Library/LaunchAgents directory
2. Check for suspicious filenames in this directory (example below is a random name)

/Users/user/Library/LaunchAgents/com.wznlVRt83Jsd.HPyT0b4Hwxh.plist

if there is a file named like above, it's very likely you have been infected