{"id":489353,"date":"2023-04-28T11:58:52","date_gmt":"2023-04-28T09:58:52","guid":{"rendered":"https:\/\/mybroadband.co.za\/news\/?p=489353"},"modified":"2023-04-28T12:04:45","modified_gmt":"2023-04-28T10:04:45","slug":"macos-information-stealing-malware-targets-over-50-crypto-wallets","status":"publish","type":"post","link":"https:\/\/mybroadband.co.za\/news\/security\/489353-macos-information-stealing-malware-targets-over-50-crypto-wallets.html","title":{"rendered":"MacOS information-stealing malware targets over 50 crypto wallets"},"content":{"rendered":"

A new information-stealing malware targeting MacOS is being distributed to cyber criminals through private Telegram channels for $1,000 (R18,350) a month, Bleeping Computer reports<\/a><\/strong>.<\/p>\n

Known as “Atomic” or “AMOS”, buyers receive a DMG file containing a 64-bit Go-based malware that targets MacOS systems to steal keychain passwords, files, passwords, cookies, and credit cards stored in browsers.<\/p>\n

It also targets more than 50 cryptocurrency extensions to steal credentials.<\/p>\n

The malware seems somewhat advanced \u2014 criminals who buy it get access to a ready-to-use web panel to manage victims, a MetaMask brute-forcer, a cryptocurrency checker, and a DMG installer. They can also receive stolen logs on Telegram.<\/p>\n

The project appears to be actively developed, with Trelix and Cyble Labs researchers noting that the author released a new malware version on 25 April 2023.<\/p>\n

Bleeping Computer notes that the DMG file goes largely unnoticed on VirusTotal, with only one of 59 antivirus engines flagging the file.<\/p>\n

It features a comprehensive set of data-stealing features. Upon executing the malicious DMG file, it presents a fake password prompt to obtain the system password.<\/p>\n

It then attempts to access MacOS’ keychain password \u2014 the built-in password manager that keeps Wi-Fi passwords, website logins, and credit card data.<\/p>\n

The Atomic Stealer malware proceeds to extract information from software running on the infected machine, including:<\/p>\n