TL;DR Gen Digital researchers uncovered a Claude malware campaign that abuses Anthropic's official website and Google Ads to infect macOS and Windows users. By hosting fake download instructions inside public Artifacts and Shared Chats on claude.ai, this fake Download Claude malware campaign tricks visitors into running ClickFix commands. Consequently, macOS victims install Atomic macOS Stealer and trojanized wallet apps, while Windows users receive a .NET remote access trojan.

CloudSyncD Malware: Fake Zoom Installer Threatens macOS A Deceptive New Threat Recently, security firm Jamf Threat Labs published an insightful report detailing a novel macOS malware named CloudSyncD. This malicious trojan cleverly disguises itself as a standard Zoom conferencing software installer. It deceptively utilizes fabricated installation instructions to manipulate unsuspecting users. Consequently, victims willingly disable the built-in macOS Gatekeeper security mechanism.

At a Glance Attribute Details Malware Family MacSync (originally advertised as Mac.c) Threat Actor Unknown cybercriminals (Malware-as-a-Service model; unconfirmed attribution) Target Victims Cryptocurrency investors, software developers, and macOS administrators Delivery Vector Malicious disk images (DMGs), fake crypto apps, and public iCloud calendars Key Capabilities Curve25519 key exchange, PAM credential validation, multi-layer persistence, data exfiltration Source Kaspersky Threat Intelligence (Securelist) Executive Summary…

At a Glance Attribute Details Actor or Group TraderTraitor (aka UNC4899, Jade Sleet, PUKCHONG) Activity Type Fake job recruitment, supply chain compromise, credential theft Targets or Victims IT services providers and cryptocurrency developers Scale Claimed USD 292 million stolen in prior intrusion; single IT endpoint in new incident Jurisdiction / Status Suspected North Korean state-sponsored threat group; uncharged Source

At a glance Factor Details Malware Family AMOS (Atomic macOS Stealer), Light Stealer, and XMRig miner Threat Actor Unconfirmed cybercrime operator (Tracked via Polygon wallet) Target or Victims macOS users, cryptocurrency holders, and developers Delivery Vector ClickFix fake CAPTCHA lure on Cloudflare Pages Key Capabilities EtherHiding blockchain C2 resolution, credential theft, crypto wallet draining, cryptomining Source NetbyteSEC Research Team TL;DR…

  North Korean state-sponsored hackers have rolled out a new macOS malware strain dubbed NimDoor, designed to infiltrate Web3 and cryptocurrency organizations. According to a fresh analysis by SentinelOne researchers, the attackers leveraged uncommon methods and an innovative signal-based persistence mechanism never observed before. The attack chain starts with threat actors reaching out to potential victims through Telegram, persuading them to execute a bogus Zoom SDK update distributed via Calendly invitations and email—an approach reminiscent of tactics recently attributed to BlueNoroff by the managed security provider Huntress. SentinelOne’s report notes that the adversaries used a mix of C++ and Nim-compiled binaries (collectively referred to as NimDoor) on macOS—"a more unusual choice." One of these binaries, named 'installer,' handles the initial setup by preparing directories and configuration paths. It then deploys two additional components—'GoogIe LLC' and 'CoreKitAgent'—onto compromised systems. GoogIe LLC focuses on harvesting environment details and generating a hex-encoded configuration file, which is saved in a temporary directory. It also sets up a macOS LaunchAgent (com.google.update.plist) to ensure the malware runs automatically at login and retains authentication keys for future use. The most advanced piece of the toolkit is CoreKitAgent, the primary payload of NimDoor. This event-driven binary leverages macOS’s kqueue mechanism for asynchronous execution and implements a 10-state machine with a hardcoded transition table, enabling dynamic control depending on runtime conditions. A particularly distinctive characteristic is CoreKitAgent’s signal-based persistence, which relies on custom handlers for SIGINT and SIGTERM—signals typically used to terminate processes. "When triggered, CoreKitAgent catches these signals and writes the LaunchAgent for persistence, a copy of GoogIe LLC as the loader, and a copy of itself as the trojan, setting executable permissions on the latter two via the addExecutionPermissions_user95startup95mainZutils_u32 function," SentinelLABS explains. "This behavior ensures that any user-initiated termination of the malware results in the deployment of the core components, making the code resilient to basic defensive actions." Once active, CoreKitAgent decodes and executes a hex-encoded AppleScript that connects to command-and-control servers every 30 seconds, exfiltrates system information, and executes remote commands via osascript, effectively acting as a stealth backdoor. Alongside the main NimDoor infection, a parallel chain initiated by 'zoom_sdk_support.scpt' deploys 'trojan1_arm64', which establishes WebSocket Secure (WSS)-based communications with attacker infrastructure. It downloads two additional scripts—upl and tlgrm—to facilitate data theft. Notably, researchers discovered that the loader script contains over 10,000 blank lines to hinder detection. Upl focuses on extracting browser data, Keychain credentials, and shell history files (.bash_history and .zsh_history), transmitting the stolen information to dataupload[.]store via curl. Meanwhile, tlgrm targets Telegram data, including .tempkeyEncrypted files, likely to decrypt private messages exchanged on the platform. Overall, SentinelLABS describes NimDoor and its associated payloads as among the most complex macOS malware attributed to North Korean threat actors so far. The framework’s modular architecture and the use of novel persistence techniques underscore how DPRK operators are continuously refining their cross-platform attack capabilities to breach cryptocurrency ecosystems and steal sensitive information. SentinelLABS’ comprehensive report provides detailed indicators of compromise, including malicious domains, file paths, scripts, and binaries linked to these intrusions.  

A new info-stealing campaign called Infinity Stealer targets macOS by delivering a Python payload compiled into a native executable with the Nuitka compiler and lures users via a ClickFix fake Cloudflare CAPTCHA. The payload performs anti-analysis checks, harvests browser credentials, macOS Keychain entries, cryptocurrency wallets and plaintext developer secrets, and exfiltrates data to a C2 via HTTP while notifying operators via Telegram; users should never paste unknown commands into Terminal. #InfinityStealer #Nuitka

Infiniti Stealer is a previously undocumented macOS infostealer delivered via a ClickFix social‑engineering scheme that tricks users into pasting a Terminal command to fetch a Bash dropper and ultimately runs a Nuitka‑compiled Python stealer. The malware decodes and executes staged payloads, removes quarantine flags, harvests browser credentials, Keychain entries, wallets, and...

XCSSET, a sophisticated macOS malware, has been upgraded to bypass antivirus. Learn how it steals data and protect yourself by updating software and being cautious of downloads. Microsoft Defender now detects it. Tools used for generation Text Gemini Narator Azure TTS Clips Pexel Rendering Remotion

Cyberkriminelle geben auf: Die Malware Banshee Stealer für MacOS wurde nach Veröffentlichung des Quellcodes aufgegeben. Der Artikel <a href="https://tarnkappe.info/artikel/it-sicherheit/banshee-stealer-quellcode-geleakt-macos-malware-unschaedlich-gemacht-304847.html">Banshee Stealer Quellcode geleakt: macOS-Malware unschädlich gemacht</a> erschien zuerst auf <a href="https://tarnkappe.info">TARNKAPPE.info</a>

A newly discovered macOS malware dubbed "Gaslight" is designed to confuse AI-assisted malware analysis tools by hiding prompt injection strings and fake debugging data within the executable.

Explore the new XCSSET macOS malware variant's tactics in crypto theft and advanced obfuscation techniques.

At a Glance Field Detail Malware family CrashStealer (native C++ macOS infostealer) Threat actor Unattributed; part of a larger multi-platform operation Targets macOS users, especially cryptocurrency holders Delivery vector Signed, notarized dropper disk image posing as an installer Key capabilities Browser, wallet, password-manager and keychain theft; AES-GCM encryption; LaunchAgent persistence Source Jamf Threat Labs (July 2026) TL;DR Jamf Threat Labs has detailed a new macOS&hellip;