Threat actors deploy fake macOS utilities to steal user data

LONDON, May 6 (Reuters) - Cybercriminals are exploiting fake macOS utilities and deceptive repair instructions to distribute infostealers targeting Apple computer users, Microsoft's Defender Security Research Team said on Tuesday.

The attack campaign, identified on May 6, uses social engineering tactics to trick victims into downloading malicious software disguised as legitimate system tools. The malware is designed to harvest sensitive information including media files, iCloud credentials, Keychain entries, and cryptocurrency wallet data.

Microsoft researchers observed the threat actors employing ClickFix-style instructions, a technique where users are directed to perform specific actions to "fix" non-existent system errors. These instructions often lead victims to download the malicious payloads under the guise of necessary system updates or diagnostic tools.

The infostealers operate silently in the background once installed, scanning the infected devices for valuable data. The malware targets specific file types and application data that are commonly stored on macOS systems, including browser cookies, saved passwords, and authentication tokens.

Security experts warn that the sophistication of these attacks is increasing, with threat actors adapting their methods to bypass macOS security features. The fake utilities are often designed to mimic the appearance of official Apple software, making them difficult for average users to distinguish from legitimate applications.

The campaign appears to be global in scope, with no specific geographic region identified as the primary target. Microsoft's analysis indicates that the attackers are likely motivated by financial gain, as the stolen data can be sold on dark web marketplaces or used for identity theft and unauthorized financial transactions.

Victims may not immediately realize their systems have been compromised, as the infostealers are designed to operate without disrupting normal system functions. By the time users notice unusual activity, such as unauthorized transactions or missing files, the attackers may have already exfiltrated significant amounts of data.

Microsoft has updated its Defender for Endpoint protection to detect and block the identified malware variants. The company is advising macOS users to exercise caution when downloading software from unverified sources and to avoid following unsolicited repair instructions.

The security firm recommends that users enable two-factor authentication for all accounts, regularly update their operating systems, and use reputable antivirus software. Organizations are advised to implement additional security measures, including network monitoring and employee training on social engineering tactics.

The full extent of the campaign's impact remains unclear, as many infections may go undetected. Security researchers are continuing to monitor the situation and investigate the infrastructure used by the threat actors to distribute the malware.

As of Tuesday, no major organizations have publicly confirmed widespread infections, though individual cases are likely occurring. The development of new detection signatures and the identification of command-and-control servers are ongoing efforts to mitigate the threat.

Users who suspect their systems have been compromised are advised to disconnect from the internet, run a full system scan, and change all passwords from a clean device. Law enforcement agencies have not yet announced any arrests or takedowns related to this specific campaign.