Uma nova investigação revela que mais de um terço das infeções por infostealers tem origem na execução de ficheiros diretamente a partir de pastas temporárias dos navegadores. Comportamentos de risco, como descarregar software de fontes não seguras, continuam a ser explorados pelos cibercriminosos.

The post 35% das infeções por infostealers começam com ficheiros descarregados da Internet appeared first on Tek Notícias.

Researchers have found a never-before-seen piece of macOS malware that combines a series of clever tradecraft to infect Macs with stealthy, custom-developed credential-stealing code.

The malware is delivered in two stages. The first is distributed in a disk image that masquerades as Maccy, a clipboard manager for Macs. It’s compiled as AppleScript that is notable for the way it delivers the second stage. The malware is named PamStealer because the Rust-written infostealer uses the Pluggable Authentication Modules interface built into macOS to validate the target’s login password before sending it to an attacker-controlled server.

A quieter execution chain

The use of both disk image and AppleScript is common in malware for Macs. More unusual is the way PamStealer combines them to gain stealth. When the AppleScript is double-clicked, it’s opened in the macOS Script Editor, where the malicious functionality is buried deep within the file.

Read full article

Comments