Article Details
Scrape Timestamp (UTC): 2024-01-11 11:46:24.259
Source: https://thehackernews.com/2024/01/atomic-stealer-gets-upgrade-targeting.html
Original Article Text
Click to Toggle View
Atomic Stealer Gets an Upgrade - Targeting Mac Users with Encrypted Payload. Cybersecurity researchers have identified an updated version of a macOS information stealer called Atomic (or AMOS), indicating that the threat actors behind the malware are actively enhancing its capabilities. "It looks like Atomic Stealer was updated around mid to late December 2023, where its developers introduced payload encryption in an effort to bypass detection rules," Malwarebytes' Jérôme Segura said in a Wednesday report. Atomic Stealer first emerged in April 2023 for a monthly subscription of $1,000. It's capable of harvesting sensitive information from a compromised host, including Keychain passwords, session cookies, files, crypto wallets, system metadata, and the machine's password via a fake prompt. Over the past several months, the malware has been observed propagated via malvertising and compromised sites under the guise of legitimate software and web browser updates. Malwarebytes' latest analysis shows that Atomic Stealer is now being sold for a hefty $3,000/month rental fee, with the actors running a promotion coinciding with Christmas, offering the malware for a discounted price of $2,000. Besides incorporating encryption to thwart detection by security software, campaigns distributing Atomic Stealer have undergone a slight shift, wherein Google search ads impersonating Slack are used as conduits to deploy Atomic Stealer or a malware loader called EugenLoader (aka FakeBat) depending on the operating system. It's worth noting that a malvertising campaign spotted in September 2023 leveraged a fraudulent site for the TradingView charting platform to deliver NetSupport RAT, if visited from Windows, and Atomic Stealer, if the operating system is macOS. The rogue Slack disk image (DMG) file, upon opening, prompts the victim to enter their system password, thereby allowing threat actors to gather sensitive information that are access-restricted. Another crucial aspect of the new version is the use of obfuscation to conceal the command-and-control server that receives the stolen information. "As stealers continue to be a top threat for Mac users, it is important to download software from trusted locations," Segura said. "Malicious ads and decoy sites can be very misleading though and it only takes a single mistake (entering your password) for the malware to collect and exfiltrate your data." The Ultimate Enterprise Browser Checklist Download a Concrete and Actionable Checklist for Finding a Browser Security Platform. Master Cloud Security - Get FREE eBook Comprehensive eBook covering cloud security across infrastructure, containers, and runtime environments for security professionals
Daily Brief Summary
An upgraded Atomic Stealer malware targeting macOS users now employs encrypted payloads to evade detection.
Initially released in April 2023 for $1,000/month, Atomic Stealer's subscription now costs $3,000/month, with a temporary discount to $2,000/month.
The malware is capable of stealing Keychain passwords, session cookies, files, cryptocurrency wallets, and other sensitive data by tricking users with a fake password prompt.
Atomic Stealer distribution includes malvertising, compromised websites, and Google search ads posing as legitimate software updates and tools like Slack.
Recent campaigns use obfuscation methods to hide the command-and-control servers, complicating efforts to track and address the threat.
Users are advised to download software only from trusted sources to avoid falling victim to malicious ads and decoy sites that facilitate data theft by the malware.