Apple Mac malware infects nearly 30,000 computers with Intel and M1 chips; attacker’s ultimate goal remains a mystery

Security researchers have recently identified a second version of a malware that has infected thousands of Apple Mac computers around the world. Despite learning that nearly 30,000 devices have been affected, experts are still trying to figure out the attacker’s ultimate goal.

macOS malware has several mysterious characteristics

The malware, which Red Canary researchers have dubbed Silver Sparrow, has two versions with Mach object binaries for Intel-based (x86_64) Mac computers and M1-powered devices. Per data collected by Malwarebytes, as of last Feb. 17, the Silver Sparrow has affected 29,139 macOS devices in 153 countries. Most infected computers are reportedly located in the United States, Canada, the United Kingdom, France, and Germany.

The recently discovered malware strain uses LaunchAgent for persistently contacting a remote host, which the security researchers say is normal for macOS adware. However, what is bizarre is that the malware JavaScript to execute commands.

Several other factors make the macOS malware even more bizarre. Researchers have studied the malware for more than a week and learned that, in every hour, it is checking for new content and command to execute.

However, the researchers have not found the final payload. The Silver Sparrow binaries are not doing much at this point, leading to its moniker “bystander binaries.” The researchers, however, pointed out that when the Intel x86_64 binaries are executed, they display the message, “Hello World!” The Apple Silicon M1 binaries, on the other hand, show the text, “You did it!” Red Canary believes these are just placeholders.

Silver Sparrow is still a ‘serious threat’ despite unknown goals

The mystery surrounding the Silver Sparrow malware does not lessen its potential threat. “Though we haven’t observed Silver Sparrow delivering additional malicious payloads yet, its forward-looking M1 chip compatibility, global reach, relatively high infection rate, and operational maturity suggest Silver Sparrow is a reasonably serious threat,” Red Canary said. With the mechanisms the malware has in place, cybersecurity experts believe it has the capacity “to deliver a potentially impactful payload at a moment’s notice.”

When researchers say this malware is mature, it refers to the fact that it is hosted on Amazon Web Services and Akamai. This means it can deliver content and commands well. Another unusual characteristic of the Silver Sparrow is that it is equipped with a self-destruct file check. The macOS malware has the ability to remove all persistent tasks and scripts by itself.

Red Canary’s blog post also offers ways to find indicators if a Mac computer has been infected by Silver Sparrow. Meanwhile, Apple confirmed that certificates for the developers involved in the spread of the malware packages have been disabled.

Featured Photo by Emile Perron on Unsplash