Mysterious malware hits 30,000 Macs

Stefan Mileschin · 23rd February 2021, 07:43

A piece of malware has been found on almost 30,000 Macs worldwide and apparently it has baffled the Tame Apple Press.

For decades it has insisted that Macs are free from the corruption of malware and yet here was one which appears to have made specifically for Apple users.

The malware has been found in 153 countries with detections concentrated in the US, UK, Canada, France, and Germany.

Red Canary, the security firm that discovered the malware, has named it "Silver Sparrow." It uses the macOS Installer Javascript API to launch a bash process to gain a foothold into the user's system, a hitherto unobserved method for bypassing malware detection.

This bash shell is then used to invoke macOS's built-in PlistBuddy tool to create a LaunchAgent which executes a bash script every hour. This is the command-and-control process, which downloads a JSON file containing (potentially) new instructions.

https://fudzilla.com/news/52398-myst...it-30-000-macs

23rd February 2021, 07:43	#1
Stefan Mileschin [M] Reviewer Join Date: May 2010 Location: Romania Posts: 153,575	Mysterious malware hits 30,000 Macs A piece of malware has been found on almost 30,000 Macs worldwide and apparently it has baffled the Tame Apple Press. For decades it has insisted that Macs are free from the corruption of malware and yet here was one which appears to have made specifically for Apple users. The malware has been found in 153 countries with detections concentrated in the US, UK, Canada, France, and Germany. Red Canary, the security firm that discovered the malware, has named it "Silver Sparrow." It uses the macOS Installer Javascript API to launch a bash process to gain a foothold into the user's system, a hitherto unobserved method for bypassing malware detection. This bash shell is then used to invoke macOS's built-in PlistBuddy tool to create a LaunchAgent which executes a bash script every hour. This is the command-and-control process, which downloads a JSON file containing (potentially) new instructions. https://fudzilla.com/news/52398-myst...it-30-000-macs

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Macs have more malware than Windows	Stefan Mileschin	WebNews	0	14th February 2020 09:36
Coin Miner Mobile Malware Returns, Hits Google Play	Stefan Mileschin	WebNews	0	1st November 2017 06:20
Google's mysterious Fuchsia OS looks like an Android re-do	Stefan Mileschin	WebNews	0	9th May 2017 06:46
Russia-backed malware can now target Macs	Stefan Mileschin	WebNews	0	16th February 2017 08:29
Sierra hits Macs on September 20th with Siri in tow	Stefan Mileschin	WebNews	0	9th September 2016 09:57
That Mysterious Windows 10 Icon On Your Desktop	Stefan Mileschin	WebNews	0	2nd June 2015 07:49
Mysterious Toshiba Portege Z10t tablet (yes, tablet) hits the FCC	Stefan Mileschin	WebNews	0	20th March 2013 11:40
Mysterious RV790 approaching	jmke	WebNews	0	19th January 2009 18:38
ATi RD600 hits 520MHz FSB, NVIDIA C55 hits 510MHz	jmke	WebNews	0	2nd October 2006 21:12