Mac users open to Remote Control via Tricky macOS Malware; hidden VNC tool

[upnorth]

Content source

https://www.darkreading.com/application-security/apple-users-remote-control-tricky-macos-malware

Recently discovered data-stealing malware is targeting macOS users with a sneaky approach that uses Hidden Virtual Network Computing (hVNC). It's being sold at a lifetime price of $60,000 on the Dark Web, with add-ons available.

Virtual Network Computing (VNC) software is typically used by IT teams to provide remote technical support to users. A doppelgänger version of the tool is hVNC, which can be bundled into malware that operates covertly, gaining access without requesting permission from the user. According to Guardz researchers, a macOS version of such a tool has emerged on Exploit, the infamous Russian underground forum. It specializes in bagging all manner of sensitive information, including login credentials, personal data, financial information, and more. Concerningly for Apple users, the malware can also survive system reboots and other attempts at removal.

Apple Users Open to Remote Control via Tricky macOS Malware

The Hidden Virtual Network Computing (hVNC) malware infests Macs and silently executes complete takeovers, with no user permission needed. It also sports persistence through reboots.

www.darkreading.com

 

[Ink]

How to protect yourself
​

Although the tool is being pitched at those wanting to gain access to Macs used in businesses, it would be equally effective against personally owned Macs.

One key to protecting yourself from this type of threat is to keep your Mac updated to the latest macOS version available for your machine. This malware only works on Macs up to and including macOS Ventura 13.2, for example, while the current version is 13.4.1.

Otherwise, standard cybersecurity hygiene measures are the key. Never install apps from outside the Mac App Store unless you know the developer is trustworthy. Never open unexpected attachments, even if they appear to come from a known contact. Never click on links in emails unless you are certain they are safe; it’s always preferable to access sites from your own bookmarks, or by typing in the URL.

Hidden VNC tool gives attackers access to Macs; $100K guarantee

Cybersecurity firm Guardz has found Russian hackers offering for sale a Hidden VNC tool specifically designed to give attackers full...

9to5mac.com

Summary​

We learned that with Hidden Virtual Network Computing (HVNC) it is possible to control a machine without the victim’s knowledge. It’s a known malware module that targets Windows OS devices, but now we see that there is also a shift to macOS machines.

Mac computers and devices are widely used by SMEs due to their reputation for security and usability. As trusted security service providers, all MSPs have a responsibility to stay up-to-date on these new threats and ensure their clients’ Mac devices remain secure.

Though Macs have historically been less targeted by cybercriminals, attackers are now developing more macOS malware. Guardz researchers believe that this kind of tool can be integrated into a variety of “Attack-as-a-Service” cybercrime services that are available on underground forums. Ignoring macOS vulnerabilities leaves SMEs at risk of business disruption, stolen intellectual property, and financial loss.

The Massive macOS Threats Trending in the Dark Web. | Guardz.com

The recent reveal of ShadowVault malware in our blog post decidedly piqued the interest of the cybersecurity news community. Keeping up-to-date with the

guardz.com

 

[vtqhtr413]

Guardz Cyber Intelligence Research (CIR) most recently uncovered ShadowVault, and reports that it has now followed up that find with a new one — made initially by AI. "In this follow-up post, Guardz CIR (Cyber Intelligence Research) team decided to leverage the power of AI, much like we do in our phishing protection service," writes the team in a blog post, "We asked ChatGPT about additional mac-OS threats that lurk somewhere on the Dark Web."

Based on the group's screenshots, ChatGPT appears to have started by just telling the firm that "yes, there are likely to be other cyber threats for macOS on the Dark Web." But there must be more, as the group then said that motivated by ChatGPT, "our researchers delved back into the depths of the cybercrime underground to authenticate this lead."

ChatGPT used to find Mac malware on the Dark Web

A cybersecurity firm says it asked ChatGPT to find new Mac security threats, and after some delving, it found one sold on a Russian server.

appleinsider.com