No fewer than six examples of Mac malware were discovered last month, including one which exploits a vulnerability in macOS Gatekeeper. The latest example – dubbed OSX/CrescentCore – takes steps to hide from security researchers.
Security company Intego says it has found CrescentCore on multiple websites, posing as, you guessed it, a Flash Player updater …
The company reported on it in a blog post.
The team at Intego has observed OSX/CrescentCore in the wild being distributed via numerous sites. Mac users should beware that they may encounter it, even via seemingly innocuous sources such as Google search results.
The new malware was first observed linked from a site purporting to share digital copies of new comic books for free—one of many shady sites that flagrantly violates U.S. copyright laws […]
A high-ranking Google search result was also observed redirecting through multiple sites, eventually leading to a page (hosted at any of a large number of domains) with flashy warnings about Adobe Flash Player supposedly needing to be updated—which in reality is a malware distribution site.
As the company notes, sketchy sites claiming to offer free versions of movies, TV shows, music and books are an extremely common source of malware.
How CrescentCore hides from security researchers
CrescentCore takes two steps to hide itself from security researchers.
If a user opens the .dmg disk image and opens the Player app (which has a Flash Player icon), the Trojan horse will first check to see whether it is running inside a virtual machine (VM). Malware analysts often examine malware inside a VM to avoid unintentionally infecting their own computers while working with dangerous files, so malware authors sometimes implement VM detection and behave differently to make it more difficult to analyze the malware’s behavior.
The OSX/CrescentCore Trojan app also checks to see whether any popular Mac antivirus programs are installed.
If the malware determines that it’s running within a VM environment or with anti-malware software present, it will simply exit and not proceed to do anything further.
We’d echo the advice from Intego about Flash.
Nobody should be installing Flash Player in 2019—not even the real, legitimate one. Nearly all sites have stopped relying on Flash, as Adobe is discontinuing it; the company plans to no longer release security updates for Flash after 2020.
Once again, the malware is signed by Apple, using developer IDs which have now been reported to the company, but it’s likely that new IDs will be used soon. Apple plays a constant game of whack-a-mole with developer IDs which have been hacked or misused.
FTC: We use income earning auto affiliate links. More.
Comments