macOS malware and infostealer campaigns

Overview

Security researchers have identified distinct macOS malware campaigns targeting user data and credentials.

One campaign, dubbed ‘MacSync’ by Huntress, uses fraudulent Claude Code installation guides hosted on the legitimate claude.ai platform via Anthropic’s chat-sharing feature. By utilizing paid Google advertisements and deceptive display names like ‘Apple Support’, the attackers direct users to execute commands in the Terminal. This six-stage malware chain installs a stealer and a remote access Trojan, ultimately replacing legitimate cryptocurrency wallet applications with Trojanized versions to harvest seed phrases.

Separately, Jamf Threat Labs identified ‘AmnesiaStealer’, a multi-stage infostealer written in Rust. This malware is distributed through counterfeit GitHub pages. It harvests sensitive information including the macOS keychain, Apple Notes, Telegram data, and browser credentials. A notable feature is its second-stage remote control module, which provides attackers interactive control over a victim’s Chromium browser to steal authenticated sessions and cookies via the DevTools Protocol.

Entities

Trezor · Huntress · GitHub · Jamf Threat Labs · Ledger

Timeline

1 day ago

[TECHNOLOGY] 7 sources
Jamf Threat Labs identifies AmnesiaStealer macOS malware
Jamf Threat Labs has discovered AmnesiaStealer, a multi-stage Rust-based macOS infostealer that uses counterfeit GitHub pages to steal credentials, Apple Notes, and hijack browser sessions.
5 days ago

[TECHNOLOGY] 3 sources
MacSync malware targets macOS users via fake Claude Code guides
A sophisticated macOS malware campaign called MacSync uses fake Claude Code installation guides on claude.ai to steal cryptocurrency by hijacking Ledger and Trezor wallet apps.

Sources

all-about-security.de · appleworld.today · countryrebel.com · cybersecuritynews.com · drweb.de · jamf.com · pcauthority.com.au · phonetoday.it · sf-encyclopedia.com