Pierluigi Paganini
September 07, 2023
Malwarebytes researchers have observed a new malvertising campaign distributing an updated version of the popular Atomic Stealer (AMOS) for Mac.
The Atomic Stealer first appeared in the threat landscape in April 2023. In April Cyble Research and Intelligence Labs (CRIL) discovered a Telegram channel advertising a new information-stealing malware, named Atomic macOS Stealer (AMOS). The malware targets macOS, it was designed to steal sensitive information from the infected systems.
The researchers reported that the Atomic Stealer is constantly improved by its authors.
The Atomic macOS Stealer allows operators to can steal various types of information from the infected machines, including Keychain passwords, complete system information, files from the desktop and documents folder, and even the macOS password.
The malware is able to steal data from multiple browsers, including auto-fills, passwords, cookies, wallets, and credit card information. AMOS can target multiple cryptowallets such as Electrum, Binance, Exodus, Atomic, and Coinomi.
“The TA also provides additional services such as a web panel for managing victims, meta mask brute-forcing for stealing seed and private keys, crypto checker, and dmg installer, after which it shares the logs via Telegram. These services are offered at a price of $1000 per month.” reads the report published by Cyble.
The development team behind the threat released a new version at the end of June.
Malwarebytes reported that threat actors have been distributing the info-stealer mostly via cracked software downloads or impersonating legitimate websites and using ads on search engines such as Google to trick victims into downloading it.
The malvertising campaign observed by Malwarebytes mainly relies on Google Ads as a distribution vector. Users searching for popular software, legitimate or cracked, were served rogue ads that point to websites hosting malicious installers.
The threat actors used a fraudulent website for TradingView, featuring three buttons to download the software for Windows, macOS, and Linux operating systems.
“Users looking to download a new program will naturally turn to Google and run a search. Threat actors are buying ads matching well-known brands and tricking victims into visiting their site as if it were the official page.” reads the report published by Malwarebytes. “The ad below for TradingView uses special font characters (tradıņgsvıews[.]com is embedded with unicode characters: trad\u0131\u0146gsv\u0131ews[.]com) perhaps as an attempt to appear like the real domain and evade detection from Google’s ad quality checks.”
Both the Windows and Linux buttons point to an MSIX installer hosted on Discord that servers the NetSupport RAT.
The Mac button points to the installer hosted at: https://app-downloads[.]org/tview.php
The downloaded file (TradingView.dmg) includes the instructions to open it bypassing the security mechanism GateKeeper.
“TradingView.dmg” is a version of Atomic Stealer that was released in June. The malware is bundled in an ad-hoc signed app that, once executed, it will prompt for the user password in a never-ending loop until victims finally provide it.
The attackers use this trick to execute the malware and steal data from victims, then they immediately exfiltrate it back to their server.
“Malvertising continues to be an effective vector to target new victims by abusing the trust they have in their search engines. Malicious ads coupled with professional-looking phishing pages make for a potent combo that can trick just about anyone.” concludes the report. While Mac malware really does exist, it tends to be less detected than its Windows counterpart. The developer or seller for AMOS actually made it a selling point that their toolkit is capable of evading detection.”
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, malware)
