Cracked macOS apps drain wallets using scripts fetched from DNS records

Hackers are using a stealthy method to deliver to macOS users information-stealing malware through DNS records that hide malicious scripts. The campaign appears directed at users of macOS Ventura and later and relies on cracked applications repackaged as PKG files that include a trojan. Researchers at cybersecurity company Kaspersky discovered the campaign and analyzed the stages of the infection chain. Victims download and execute the malware after following installation instructions to place it in the /Applications/ folder, assuming it is an activator for the cracked app they had downloaded. This opens a bogus Activator window that asks for the administrator password. With permission granted, the malware runs a 'tool' executable (Mach-O) via the 'AuthorizationExecuteWithPrivileges' function and then checks for Python 3 on the system, and installs it if not present, making the process appear like "app patching." Next, the malware contacts its command and control (C2) server, at a site deceptively named "apple-health[.]org," to fetch a base64-encoded Python script that can run arbitrary commands on the breached device. The researchers found that the attacker used an interesting method to contact the C2 server at the correct URL: words from two hardcoded lists and a random sequence of five letters as a third-level domain name. "With this URL, the sample made a request to a DNS server as an attempt to get a TXT record for the domain" - Kaspersky By using this method, the threa...