Threat Report: Stealers on the Rise

Published: Feb 4, 2025

Short Description:
This report examines the increasing prevalence of macOS infostealers, focusing on three prominent threats: Atomic Stealer, Poseidon Stealer, and Cthulhu Stealer. These malware variants target sensitive information such as financial details, credentials, and intellectual property.

Distribution Methods:
– Malicious apps disguised as legitimate software (e.g., cracks for paid applications)
– Phishing emails with malicious attachments or links
– Exploit kits and malvertising

Execution Processes:
– Atomic Stealer: Uses launch agents to persistently run the malware upon login.
– Poseidon Stealer: Utilizes a legitimate software’s signature to bypass Gatekeeper restrictions.
– Cthulhu Stealer: Employs a custom launcher that uses task scheduling API for persistence.

Data Exfiltration Techniques:
– Data is sent via HTTP(S) to command and control (C2) servers managed by threat actors.
– Some stealers also exfiltrate data stored in the Keychain, browsers, and other sensitive locations.

Threat Trends:
– There was a 101% increase in macOS infostealer detections between the last two quarters of 2024.

Recommendations:

1. User Awareness: Educate users about the risks associated with downloading software from untrusted sources and opening suspicious email attachments.
2. Advanced Detection Modules: Implement advanced detection modules in your security systems to identify macOS malware more effectively.
3. Multi-layered Defense Strategies: Employ multi-layered defense strategies, combining solutions like antivirus software, firewalls, application control, and network monitoring.
4. Regular Updates & Patches: Keep all applications and operating systems up-to-date with the latest security patches.

   External References:

• AlienVault OTX
  • Unit 42 by Palo Alto Networks