New FlexibleFerret Malware Chain Targets macOS With Go Backdoor

A brand new macOS malware chain that makes use of staged scripts, credential-harvesting decoys and a persistent Go-based backdoor has been noticed to bypass consumer safeguards, disguise its exercise and preserve long-term entry to compromised programs.

In response to a brand new advisory from Jamf Menace Labs, the marketing campaign features a second-stage shell script that reconstructs a obtain path and fetches totally different payloads based mostly on whether or not a system runs on arm64 or Intel chips.

The cybersecurity researchers famous the script retrieved an archive containing the next-stage loader, unpacked it into a short lived listing, then launched the element within the background.

It additionally established persistence by writing a LaunchAgent that pressured the loader to run at login. Jamf stated the script then opened a decoy software that imitated Chrome permission prompts and in the end displayed a Chrome-style password window designed to steal credentials.

Read more on macOS malware threats: macOS Stealer Campaign Uses “Cracked” App Lures to Bypass Apple Security

The decoy routed stolen passwords to a Dropbox account. To keep away from detection, the malware assembled the Dropbox host from small string fragments, then used the authentic Dropbox add API for exfiltration. It additionally queried api.ipify.org to seize the sufferer’s public IP deal with.

The Function of the Go-Primarily based Backdoor

As soon as the third stage started, the loader script invoked a malicious Golang mission named CDrivers. This backdoor generated a brief machine identifier, checked for duplicates, then linked to a hard-coded command server. From there, it entered a persistent command loop that dealt with duties akin to:

• Amassing system info

• Importing or downloading recordsdata

• Executing shell instructions

• Extracting Chrome profile information

• Triggering automated credential theft

If an error occurred, the malware fell again to a system-information command and paused for 5 minutes earlier than resuming exercise, stopping single failures from stopping the operation.

Jamf attributed the marketing campaign to FlexibleFerret operators, who proceed to refine lures designed to persuade targets to run scripts manually.

“Organizations ought to deal with unsolicited ‘interview’ assessments and Terminal-based ‘repair’ directions as high-risk, and guarantee customers know to cease and report these prompts somewhat than comply with them,” the researchers concluded.