Mac data-stealer malware roundup: AtomicStealer, MetaStealer, Realst all lively in September

Malware

Posted on
September twenty second, 2023 by

Joshua Lengthy

Intego is at present getting ready an unique write-up on a brand new macOS data-stealer malware marketing campaign. However whereas we put together to publish that piece, we wished to share highlights of another current developments concerning data-stealing malware households on the Mac.

Listed here are some fast updates about three macOS stealer malware households: AtomicStealer, MetaStealer, and Realst Stealer.

On this article:

AtomicStealer replace: a current Google Advertisements marketing campaign

In keeping with a September 6 write-up by Jérôme Segura, a current Google Advertisements marketing campaign appeared to have pushed AtomicStealer malware (often known as AMOS or AtomStealer).

The malicious Goodle Advertisements marketing campaign focused folks trying to find TradingView, a multi-platform app for monitoring “shares, currencies, cryptos, futures, CFDs and extra.”

A lookalike web site was arrange that was almost an identical to the true TradingView Desktop obtain web page. If victims clicked on the Home windows obtain hyperlink, they might get an installer for Home windows RAT malware referred to as NetSupport. And if victims clicked on the Mac obtain hyperlink, they might get AtomicStealer as an alternative.

As we talked about in our Might 2023 write-up about AtomicStealer, it makes an attempt to exfiltrate plenty of extremely delicate information from contaminated Macs. This contains passwords, stay-logged-in session cookies, and cryptocurrency wallets, amongst different issues. Take a look at our earlier protection right here:

Atomic Stealer: Thieving Mac malware offered by way of Telegram

MetaStealer being utilized in focused assaults for months

In a September 11 write-up, Phil Stokes shares current analysis into MetaStealer, a really related household of data-stealing malware.

MetaStealer has not too long ago been distributed as a Malicious program masquerading as Adobe Photoshop, PDF information, and even TradingView—similar to the current AtomicStealer marketing campaign.

However in contrast to the current AtomicStealer marketing campaign, MetaStealer seems tends for use in additional focused assaults, particularly concentrating on companies. Stokes notes that one VirusTotal consumer who uploaded a pattern a number of months in the past left a remark indicating how she ended up with the malware:

“I used to be focused by somebody posing as a design shopper, and didn’t understand something was out of the strange. The person I’d been negotiating with on the job this previous week despatched me a password protected zip file containing this DMG file, which I assumed was a bit odd.

“Towards my higher judgement I mounted the picture to my pc to see its contents. It contained an app that was disguised as a PDF, which I didn’t open and is after I realized he was a scammer.”

Some samples of MetaStealer appear to concentrate on stealing Telegram information, in addition to information from Meta apps—therefore the malware’s nickname.

Realst Stealer replace: venture could also be actively recruiting

Photographer and artist Stu Sontier (@stusontier) reached out to us with a follow-up concerning on our article on Realst malware:

Mac stealer malware Realst disguises itself as video video games, is macOS Sonoma-ready

Sontier says that he was not too long ago contacted by “a scammer who DMed me with a ‘Love your art work, do you do commissions’ message.” He notes that such direct messages typically result in malware “disguised as collaboration paperwork.” Such malware could steal cryptocurrency wallets, amongst different issues. Many customers of X/Twitter and the chat platform Discord have reported receiving direct messages from scammers resulting in wallet-stealing malware all through 2022 and 2023.

This time, Sontier famous that the account that direct-messaged him appeared to be affiliated with a Realst Stealer venture. We famous in August that Realst disguises itself as video video games, however its precise intent is to steal cryptocurrency wallets and passwords from victims.

Sontier alerted us to the title of a brand new Realst-related sport title not talked about in our August article: “Sprint Land Metaworld.” He famous that accounts on X (previously generally known as Twitter), YouTube, Instagram, and Medium had been related to this supposed online game. Sontier thought that the venture regarded like “an try and resurrect” Daybreak Land Metaworld.

Intego did some additional investigation. We uncovered proof that Sprint Land Metaworld accounts had been, in actual fact, renamed and rebranded accounts that had beforehand been Daybreak Land Metaworld-branded.

The rebrand seems to have occurred the identical week Intego revealed our Realst exposé article.

The @DashMetaLand X account most not too long ago posted on August 2. That put up states, partially, “We’ve rebranded our sport to extend the exercise of the viewers, it was a tough choice however so our sport seems extra fashionable and recent.” The put up features a screenshot displaying the brand new emblem as “DashLand MetaWorld” or “Sprint Land Meta World.”

The put up has replies from a mix of shill accounts affiliated with the venture, in addition to different accounts warning that the venture is a rip-off. Up to now, @DashMetaLand has not posted on X since then.

However based mostly on Sontier’s report and different proof, it looks like the venture could also be ongoing and actively recruiting.

One other little bit of proof that the marketing campaign remains to be lively comes within the type of a newly registered area title. The @DashMetaLand X profile lists the area dash-land[.]io in its firm Location. This area was registered on September 12—the day earlier than Sontier intially contacted Intego.

Furthermore, we found a September 3 Instagram put up that seeks to recruit “sport testers” for “a brand new NFT venture” associated to DashLand, claiming to supply “good pay.”

Apparently, the Instagram account claims the venture is predicated in Japan. This differs from the X account, which claims the venture’s headquarters is a small workplace constructing in “Jers (UK),” referring to Jersey, a self-governing British Crown Dependency island situated between France and the UK.

Many Realst promo accounts nonetheless not suspended

In the meantime, a number of older accounts affiliated with Realst malware, most of which seem like inactive since earlier than @DashMetaLand final posted, nonetheless haven’t been suspended.

On X, for instance, @brawlearth, @olympreptiles, @RyzeX_web3, and @WildmenWorld all nonetheless exist. (@GuardiansMeta, which seems within the screenshot above, could have been suspended or deleted; the username now belongs to another person.) All the accounts have misplaced followers since early August, however probably the most dramatic drop by far was @WildmenWorld. It beforehand had almost 8,400 followers and now has fewer than 3,900—lower than half as many as earlier than. This would possibly point out that the account’s followers had been bolstered by bot accounts that X has since suspended; the platform has reportedly purged hundreds of bot accounts throughout the previous month.

How can one take away or stop Mac stealer malware?

Intego VirusBarrier X9, included with Intego’s Mac Premium Bundle X9, can shield towards, detect, and get rid of AtomicStealer, MetaStealer, Realst Stealer, and different kinds of Mac malware too quite a few to call right here.

For those who imagine your Mac could also be contaminated—or to forestall future infections—use trusted antivirus software program. VirusBarrier is award-winning antivirus software program, designed by Mac safety consultants, that features real-time safety. It’s suitable with a wide range of Mac {hardware} and OS variations, together with the newest Apple silicon Macs operating macOS Sonoma.

Moreover, in case you use a Home windows PC, Intego Antivirus for Home windows can maintain your pc protected against PC malware.

VirusBarrier X6, X7, and X8 on older Mac OS X variations additionally present safety. Notice, nonetheless, that it’s best to improve to the newest variations of macOS and VirusBarrier; this can assist guarantee your Mac will get all the newest safety updates from Apple.

How can I study extra?

Make sure to take a look at Intego’s earlier protection of different data-stealer Mac malware from 2023: PureLand, FakeGPT, MacStealer, AtomicStealer, ShadowVault, and Realst.

For added technical particulars and indicators of compromise (IOCs) for a few current AtomicStealer and MetaStealer campaigns, you possibly can learn Jérôme Segura’s write-up and Phil Stokes’ write-up, respectively.

Every week on the Intego Mac Podcast, Intego’s Mac safety consultants talk about the newest Apple information, together with safety and privateness tales, and supply sensible recommendation on getting probably the most out of your Apple gadgets. Make sure to observe the podcast to be sure you don’t miss any episodes.

You too can subscribe to our e-mail e-newsletter and maintain a watch right here on The Mac Safety Weblog for the newest Apple safety and privateness information. And don’t overlook to observe Intego in your favourite social media channels:       

About Joshua Lengthy

Joshua Lengthy (@theJoshMeister), Intego’s Chief Safety Analyst, is a famend safety researcher, author, and public speaker. Josh has a grasp’s diploma in IT concentrating in Web Safety and has taken doctorate-level coursework in Info Safety. Apple has publicly acknowledged Josh for locating an Apple ID authentication vulnerability. Josh has performed cybersecurity analysis for greater than 25 years, which has typically been featured by main information shops worldwide. Search for extra of Josh’s articles at safety.thejoshmeister.com and observe him on Twitter/X, LinkedIn, and Mastodon.
View all posts by Joshua Lengthy →