Mac users should be on the lookout for fake browser updates that can steal your passwords, cybersecurity experts have warned.
A new malware campaign targeting Apple products tricks users into downloading a ‘browser update’ which actually contains a ‘one hit smash-and-grab’ virus.
Cybercriminals are even creating malicious ads on Google which impersonate familiar and legitimate tech brands to lure in potential targets.
Once you have entered the website, fake pop-ups will prompt you to download a browser update to view the site.
Worryingly, the fake prompts are extremely convincing, and even a savvy user could be tricked if they don’t know what to look for.
Could you spot that this is fake? Cybercriminals are using fake pop-ups to trick users into downloading password-stealing malware
The malware, which has been dubbed ClearFake by cybersecurity researchers, is a new version of the widely used Atomic Stealer attack.
However, this earlier version only targeted Windows machines, whereas this new attack targets Mac OS and is more sophisticated in its techniques.
Previously, hackers would hide the virus in fake versions of popular software like Microsoft Office which they would claim had been ‘cracked’ for free download.
Now, hackers are buying ads on Google, most likely through hijacked websites, to lure users to fake websites.
Users are then prompted to update their browser to view the page and are instructed on how to open the file.
As soon as the target runs the program, the virus steals the user’s data and sends it to a remote ‘command and control server’ to be collected and monetized by the criminals.
Once users enter the fake website they are prompted to install a browser update which secretly contains the malware
Users are given instructions on how to download the malicious file which immediately begins to steal information from their computer
Jérôme Segura, a researcher at Malwarebytes, who has been tracking the malware, says that this is ‘one of the most prevalent and dangerous social engineering schemes.’
Hidden inside the virus’ code, the researchers found commands to extract users’ passwords, auto-fills, user information, wallets, browser cookies, and keychain data.
Mr Segura said: ‘This may very well be the first time we see one of the main social engineering campaigns, previously reserved for Windows, branch out not only in terms of geolocation but also operating system.’
Researchers reported that a Telegram channel operated by the virus’ creators has emerged.
For $1,000 (£797) a month, criminals can rent the malware on a subscription basis and deploy it how they want.
Malwarebytes found that one ‘threat actor’ was distributing malware bought on the channel through hundreds of compromised websites.
Security vendor SentinelOne, which has also been tracking the attack since its discovery, says the channel had over 300 members in May.
Interestingly, SentinelOne researchers note that the virus does not linger on a target’s computer but instead uses a ‘one-hit smash and grab methodology’.
The fake updates have been specifically tailored for Mac and target Safari and Chrome, the two most popular Mac web browsers
Hidden within the code researchers discovered commands to steal users’ passwords, wallets, browser cookies and more
Fake browser updates on Windows systems are not uncommon and have existed for years, but this kind of attack has not yet been used to target Mac systems.
This warning comes amid a broader increase in the danger for Macs online as reports find a 1,000 per cent increase in the number of threat actors targeting Apple products since 2019.
To stay safe online, Malwarebytes recommends that Mac users download a web protection tool which can block the malicious infrastructure used for the attack.
Additionally, users should be careful when following links to non-trusted sites and check carefully before downloading any content.
MailOnline has contacted Apple and Google for comment.
This post first appeared on Dailymail.co.uk
