Here is another reason why you shouldn’t download cracked or pirated software to your macOS devices there’s malware hiding within.
Cybersecurity researchers from Kaspersky are warning of a new piece of malware, built for the Apple ecosystem, being distributed on websites claiming to offer cracked applications.
Victims would download a PKG file, thinking they were getting an activator for a cracked app they previously downloaded. They would place the PKG in the /Applications/ folder, as part of the instructions to “activate” the cracked piece of software.
macOS malware strikes again
On the surface, the malware works as “intended” the victim will get a bogus Activator window, asking for the administrator password. Granted, the malware proceeds to contact its command and control (C2) server and get a script capable of running arbitrary commands on the target endpoint.
An interesting thing about this malware is how it contacts the C2 server at the correct URL it pulls words from two hardcoded lists and adds a random sequence of five letters as its thirdlevel domain name. That way, the malicious activity is hidden inside normal traffic.
“With this URL, the sample made a request to a DNS server as an attempt to get a TXT record for the domain”, Kaspersky explained.
The final payload grants the attackers all kinds of advantages, from backdoor access, to information about the compromised system, and more. Among other things, the malware will look for Bitcoin Core and Exodus wallets on compromised devices, and if it finds them, replaces them with backdoored copies. Once the victim tries to log into their wallets again, they could have their funds drained almost instantly.
Via BleepingComputer