Interesting mystery. New malware found on ~30,000 Macs is raising ??. Once hourly the Macs contact a control server to check for commands from attackers, but so far no payload delivered. Malware has self-destruct feature but attackers haven't triggered it. arstechnica.com/information-te…
The malware has been found in 153 countries. One version runs on M1 chip that Apple introduced in Nov, "making it only the second known piece of macOS malware to do so... it uses the macOS Installer JavaScript API to execute commands." Red Canary report: redcanary.com/blog/clipping-…
“Though we haven’t observed [it] delivering additional malicious payloads yet, its...M1 chip compatibility, global reach, relatively high infection rate, and operational maturity [make it] uniquely positioned to deliver a potentially impactful payload at a moment’s notice”
When executed the x86_64 binary displays the wrds "Hello World!" and the M1 binary "You did it!" Researchers suspect the files are placeholders "to give the installer something to distribute content outside the JavaScript execution." Apple has revoked developer cert for both.
"It checks for the presence of ~/Library/._insu on disk and if the file is present Silver Sparrow removes all of its components...The ._insu file [however] does not appear present by default on macOS, and we currently don’t know the circumstances under which the file appears"
For those who are asking, the IoCs for the Silver Sparrow threat are at the end of the Red Canary report, which you can find here: redcanary.com/blog/clipping-… 
• • •
Missing some Tweet in this thread? You can try to
force a refresh
