Instead, it opts to steal as much information as possible in what's a smash-and-grab attack. The identity of the threat actor behind Atomic Stealer is currently unknown.Īnother significant trait of Atomic Stealer is its lack of persistence mechanism due to a macOS Ventura feature that alerts users when new apps or services are added to the list of "login items" that are automatically executed when the device starts. The new version masquerades as a game installer and incorporates a "larger number of functions focusing on Firefox and Chromium browsers" but at the same time leverages game-related lures to target cryptocurrency users.Īdditionally, the presence of grammatical and spelling errors is an indication that the developer's first language is likely not English. SentinelOne, in a follow-up analysis published earlier this week, disclosed details of a previously unreported second variant of Atomic Stealer and the use of Google Ads as a distribution vector for the malware.
Passwords keychain install#
The development is another sign that macOS is increasingly becoming a lucrative target beyond nation-state hacking groups to deploy stealer malware, making it imperative that users only download and install software from trusted sources, enable two-factor authentication, review app permissions, and refrain from opening suspicious links received via emails or SMS messages. The ZIP file of the compiled information is then sent to pre-configured Telegram channels. Save My Seat!Ītomic then proceeds to harvest system metadata, files, iCloud Keychain, as well as information stored in web browsers (e.g., passwords, autofill, cookies, credit card data) and crypto wallet extensions, all of which are compressed into a ZIP archive and sent to a remote server.
Passwords keychain how to#
Join our webinar and learn how to stop ransomware attacks in their tracks with real-time MFA and service account protection.
Learn to Stop Ransomware with Real-Time Protection
0 kommentar(er)
