Share this page!

Objective-See Profile picture
Twitter logo
Jul 19 • 3 tweets • 3 min read
Excellent writeup published by @ESETresearch / @marc_etienne_ on "CloudMensis" 🍎👾

...a new macOS backdoor that "uses cloud storage as its C&C channel and to exfiltrate documents, keystrokes, and screen captures"👀

welivesecurity.com/2022/07/19/i-s…
Just uploaded samples of CloudMensis to our public Mac Malware Collection! #SharingIsCaring

⚠️Direct download link: objective-see.com/downloads/malw… (password: infect3d)
And yes, our free/open-source tools will alert you in multiple proactive ways, even with no a priori knowledge of this new threat! 🔥

▫️Persistence (BlockBlock)
▫️Network Access (LuLu)
▫️etc...

...and KnockKnock can show if you're already infected!

🛠: objective-see.org/tools.html

• • •

Missing some Tweet in this thread? You can try to force a refresh
　

Keep Current with Objective-See

Objective-See Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @objective_see

Objective-See Profile picture
May 2
"Objective by the Sea" the Mac Security Conference, is back for v5.0!! 😍🥳 #OBTS

📍 Spain (near Barcelona)
🧑🏻‍💻 Trainings: Oct 3rd - 5th
🧑🏻‍🏫 Presentations: Oct 6th - 7th

Submit a talk or register today:
objectivebythesea.org/v5/index.html

...we can't wait to see y'all in sunny Spain! 🇪🇸
#OBTS v5.0 will be held at the lovely Le Méridien Ra Beach Hotel & Spa.

Only ~30 minutes south of Barcelona, the venue is located right on the sunny Mediterranean Sea ☀️🌴

We've negotiated a discounted group rate, so book thru the conference site: objectivebythesea.org/v5/location.ht…
We're also stoked to offer new and expanded (3-day) trainings at #OBTS v5.0:

Training 0x1: "The Art of Mac Malware: Detection & Analysis" by @patrickwardle

Training 0x2: "Arm Reverse Engineering & Exploitation" by @Fox0x01 🦊

For more info/to sign up:
objectivebythesea.org/v5/trainings.h…
Read 9 tweets
Objective-See Profile picture
Jan 26
👾 New Blog Post: Analyzing OSX.DazzleSpy

Discovered by @ESET, DazzleSpy is a fully-featured cyber-espionage macOS implant, installed via a remote Safari exploit ☠️

The targets?
Pro-democracy supporters in Hong Kong.

Read: Analyzing OSX.DazzleSpy
objective-see.com/blog/blog_0x6D…
@ESET's blog post (written by @marc_etienne_ & @cherepanov74) on DazzleSpy is a must read!

...especially for details on the Safari exploit used to remotely deliver the malware! 🍎🐛

welivesecurity.com/2022/01/25/wat…
If you want to play along, we've also uploaded a DazzleSpy sample to our public macOS malware collection. #SharingIsCaring

👾 objective-see.com/downloads/malw… (pw: infect3d)
Read 4 tweets
Objective-See Profile picture
Dec 22, 2021
⚠️ In macOS 12 (beta 6), Apple patched an intriguing flaw. Discovered by Gordon Long (@ethicalhax), CVE-2021-30853 allowed attackers to bypass:

▫️Gatekeeper
▫️Notarization
▫️File Quarantine

Interested in exactly how?

Read: "Where's the Interpreter!?"
objective-see.com/blog/blog_0x6A…
In short, unsigned, non-notarized script-based applications would be allowed if their script did *not* specify an interpreter! 🤯🤣

Meaning attackers could trivially bypass a myriad of foundational macOS security mechanisms via:

#!
<any malicious commands>
The issue begins in user-mode, where xpcproxy invokes posix_spawnp to launch the interpreter-less script-based application.

This initially errors out (no interpreter → ENOEXEC), but then posix_spawnp "recovers" and (re)executes the script ...this time directly via /bin/sh:
Read 5 tweets
Objective-See Profile picture
Nov 11, 2021
Google uncovered a sophisticated attack that leveraged both iOS & macOS exploits (n-/0-days) to infect Apple users! 👀

Interested in a triage of the macOS implant (named OSX.CDDS), including:
▫️ Installation
▫️ Persistence
▫️ Capabilities

📝 Have a read:
objective-see.com/blog/blog_0x69…
Of course, we're sharing a sample (as always) + the binaries/modules dropped by the implant 😇 #SharingIsCaring

👾 Download: objective-see.com/downloads/malw… (pw: infect3d)
Also be sure to also read:

1️⃣ Google's Threat Analysis Group (TAG) authoritative analysis on the attack/exploits: blog.google/threat-analysi…

2️⃣ @lorenzofb's excellent writeup
vice.com/en/article/93b…

📝🙌🏽
Read 5 tweets
Objective-See Profile picture
Sep 15, 2021
⚠️ A new malware campaign is targeting Mac users via sponsored search results & poisoned installers.

📝 Blog post analyzes stealthy trojanization mechanism, 2nd & 3rd stage payloads, and more!

+ samples! 😇

Read:
objective-see.com/blog/blog_0x66…

H/T @CodeColorist for discovery! 🙏
Original discovery: zhuanlan.zhihu.com/p/408746101 🙌
...and (as always?) LuLu has got you covered 😍 Image
Read 4 tweets
Objective-See Profile picture
May 17, 2021
[ #OBTS News ]

Objective by the Sea v4.0 (2021):
objectivebythesea.com/v4/

👨‍🏫 Training: 09/28 - 09/29
💬 Presentations: 09/30 - 10/01

📍 Location: Maui, Hawaii, USA

Can't wait to see y'all in lovely Maui!! ☀️🌴
...more details (venue, registration, etc.) soon!
#OBTS v4.0 Call For Papers now open!

Themes of interest are 🍎-security topics, such as:
⚙️ OS internals
🦠 Malware analysis
🛠️ Tool making & breaking
🐛 Bug discovery & exploitation

CFP details: objectivebythesea.com/v4/cfp.html
We've selected the newly remodeled beachside Westin Resort & Spa, in Ka'anapali Maui to host #OBTS v4.0🏖️ 😎

We've also secured a block of rooms at a massively discounted group rate. These will sell out, so don't wait (too long)!

More info / to book: objectivebythesea.com/v4/attending.h… ImageImageImageImage
Read 7 tweets

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Don't want to be a Premium member but still want to support us?

Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!

Ethereum

0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy

Bitcoin

3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us on Twitter!

:(