MacSync malware breaks through the macOS Gatekeeper protection system.

MacSync malware can easily break through macOS's Gatekeeper protection system.

MacOS was once known for its malware-free, high system strength, but today this belief may have to be questioned, as a variety of malware has begun to attack the system, some of them smart to break through the security systems of the strong operating system.

According to a report by the website Webpronews, malware has been detected that attacks a group of users of the new macOS operating system called MacSync Stealer. The malware is an Infostealer or malware that aims to steal the victim's data, which is aimed at stealing sensitive information such as passwords saved on web browsers, encryption codes, and personal information. There is also something that makes this malware even more special: the ability to easily evade Apple's cyber protection tools like Gatekeeper. The need to work through the Terminal tool allows the malware to access the system and then secretly work so quietly that the victim is unaware.

The MacSync malware spread campaign, hackers insert malware into applications written on the Swift language in the form of dripper, often disguising popular applications such as PDF Viewer. The file is accompanied by a pseudo-PDF decoy to distract the victim. In addition, a genuine Apple Developer ID or Apple Developer ID is used on this application file, allowing the Gatekeeper to understand that the application is genuine, harmless, and that by disguising it is a genuine application, the malware will be able to evade detection. Other protection tools like XProtect or Malware Removal Tool go at the same time because the system believes that the application using the genuine ID is harmless (Apple later removed the Apple Developer ID associated with this malware).

After running the file, the malware will first check the network (Network) that the malware is running under simulated conditions (Sandbox). If it is found to be running in normal conditions, it will start running the script to contact the C2 or Command and Control server to download the real malware (Payload). The real malware, in addition to the above-mentioned capabilities, has the ability to open the back door of the system to communicate with the C2 server and secretly send the stolen data back to the server (Exfiltration). In addition to that, MacSync malware is used. Built to run in module form (Module), the malware can download add-on modules to add new capabilities to the malware by avoiding the built-in detection system at the same time.

Apple, after learning of the existence of the malware, reviewed and immediately canceled the Apple Developer ID associated with the malware, and updated the unique characteristics of the malware (Signature) to XProtect to help detect the malware.

# Trending # lemon 8 diary # Lemon 8 Howtoo # macos # freedomhack