MacOS Malware Targets Slack and Discord Chats Discussing Crypto Market

Poorly made MacOS malware has been found by security researchers to be targeting Slack and Discord channels discussing the crypto market. Information regarding the attack was released on June 30 by network security expert Remco Verhoef, Cointelegraph reported.

Verhoef detailed in a blog post that the attack involved the hackers pretending to be administrators of the chats. They would then share snippets that would prompt the downloading, launching, and installation of a malicious binary.

Once in place, the software would attempt to connect to a command and control (C&C) server run by the hackers. If the connection was completed, attackers could then force the compromised devices to run a code.

Moreover, the MacOs malware was also designed to steal passwords of crypto investors and store them on the server. This server was identified as the Netherland-based headquarters of German provider CrownCloud. Complicated as the software seems, security expert Patrick Wardle said that it was actually poorly made.

“Apparently attackers are asking users to infect themselves,” Wardle remarked. He went on to criticize the malicious software’s persistence mechanism, calling it “lame” due to it opting to place the code into the Launch Daemons directory.

Furthermore, Wardle explained that the malware’s capabilities were rather constrained and so were easy to spot. It stored the stolen passwords in “dumpdummy.” All of these factors led to Wardle labeling the malware “dumb.”

In May, Mac users were also hit by poorly designed MacOS malware that made the fans of the infected devices whirring out of control. While it was easy to get rid of the malicious software, Malwarebytes' director of Mac & Mobile Thomas Reed said that attacks like these don’t bode well for the community as a whole.

Cybersecurity firm Carbon Black released a report last month stating that there was about $1.1 billion worth of stolen digital assets in the first half of 2018 alone.