CuraSec

tag: Macos-Malware · 4 items

Plan archived PamStealer macOS Malware Adds Server-Side Decryption and Persistence
2026-09-26 · The Hacker News · source ↗ #macos-malware#persistence#evasion
  • Engineer — Learn: No CVE to patch, but the server-side payload decryption design defeats static analysis of artifacts — informs how macOS endpoint security and EDR controls should be evaluated for JXA-based dropper chains in your fleet.
  • SOC/IR — Plan: Build or tune macOS detections for JXA dropper execution and multi-stage persistence mechanisms using the Jamf Threat Labs analysis; server-side decryption means behavioral detection at runtime matters more than file-hash matching.
  • Leader — Skip
Plan archived SANS ISC: Malware Analysis of Macfinger ClickFix Campaign
2026-09-25 · SANS ISC · source ↗ #clickfix#macos-malware#campaign-analysis
  • Engineer — Learn: ClickFix campaigns abuse clipboard to trick users into running malicious commands — relevant to teams managing macOS endpoints. Summary is too thin to extract specifics; read the full SANS diary to check for any IOCs or configuration hardening points applicable to your Mac fleet.
  • SOC/IR — Plan: ClickFix is a technique with detectable behavioral surface (clipboard abuse leading to terminal/shell execution). Review the full SANS ISC diary for published IOCs and consider tuning EDR behavioral detections to catch suspicious clipboard-sourced command execution on macOS endpoints.
  • Leader — Skip
Plan archived Atomic macOS Stealer (AMOS) Uses Fake Setup Guides to Steal Credentials
2026-09-16 · Unit 42 · source ↗ #macos-malware#credential-theft#infostealer
  • Engineer — Learn: AMOS targets macOS endpoints via social engineering, not a vulnerability in software you patch — review whether your macOS fleet enforces Gatekeeper and restricts unsigned app installs.
  • SOC/IR — Plan: Unit 42’s analysis maps AMOS TTPs worth building detections for; queue a review of EDR telemetry for suspicious macOS credential-access patterns and staged data exfiltration consistent with this stealer.
  • Leader — Skip
Plan archived CrashStealer macOS Stealer Abuses Notarized Dropper to Evade Gatekeeper
2026-07-14 · The Hacker News · source ↗ #macos-malware#infostealer#gatekeeper-bypass
  • Engineer — Learn: The native C++ implementation and Apple notarization abuse represent a more evasion-resistant stealer design than typical macOS threats; no CVE or patch exists, but engineers managing macOS endpoints should verify their EDR (Jamf, CrowdStrike Falcon for Mac, etc.) detects this family before active campaigns emerge.
  • SOC/IR — Plan: The notarized-dropper technique complicates Gatekeeper-based detection signals; SOC teams with macOS in scope should plan detections around post-notarization behavioral indicators (local password validation, C++ stealers) and check whether Jamf Threat Labs has published IOCs or YARA rules to incorporate this quarter.
  • Leader — Skip