Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

macOS Malware Impersonates The Unarchiver App to Steal User Data

hunt.io | blog | #malware | #phishing | #macos | #the-unarchiver | #cryptotrade | #grabber

Summary

Hunt.io dissects a spoofed The Unarchiver site pushing an unsigned macOS disk image whose 'CryptoTrade' binary and Grabber payload steal user data while evading most security vendors.
Published
Collected

original ↗

Related coverage

blog · aikido.dev
Compromised Flutter package on pub.dev contains XCSSET malware
Aikido found XCSSET malware in universal_file_viewer 0.1.5 on pub.dev: an infected maintainer machine injected worm build hooks into example files, the first compromised package found on pub.dev.
blog · netspi.com
Staying Safe Online During the COVID-19 Pandemic
Draws parallels between computer and medical viruses and catalogs COVID-themed phishing lures, from fake doctor advisories to HR bonus emails, urging caution with links and attachments.
blog · netspi.com
Why Do People Confuse “End-to-End Encryption” with “Security”?
Explains why end-to-end encryption in apps like WhatsApp isn't overall security: encrypted channels still deliver phishing links and malware, and endpoint and application risks remain fully in play.
blog · hunt.io
Redis Cryptomining Botnet Compromised 3,562 Servers, Exposed by the Operator's Own Files
Hunt.io parsed a Redis cryptomining botnet's own exposed logs: 3,562 servers compromised, rogue replication as the only technique that scaled, and 72.6% success against a no-auth target list.
blog · hunt.io
Odyssey Stealer & AMOS Hit macOS Developers with Fake Homebrew Sites
A macOS campaign targeting developers via fake Homebrew, TradingView and LogMeIn download portals delivered Odyssey Stealer and AMOS, with 85+ phishing domains tied to multi-year infrastructure.
blog · hunt.io
Clickfix on macOS: AppleScript Stealer, Terminal Phishing, and C2 Infrastructure
A macOS ClickFix campaign uses fake security prompts to push victims into running AppleScript via Terminal, stealing browser data, crypto wallets, and documents without any download.
back