Apple users have been issued a warning by cybersecurity firm Kaspersky regarding a verified macOS exploit that targets the latest operating system version, regardless of whether it runs on Intel or Apple Silicon devices.
The exploit’s primary aim is to deceive users of Bitcoin and Exodus wallets into unknowingly downloading a fraudulent version of the software.
Kaspersky noted that the malware, distributed through pirated applications, is unique in its focus on compromising wallet applications. Unlike typical proxy trojans or remote control software, this malware has two distinctive features.
First, it uses DNS records to deliver a malicious Python script. Second, instead of merely stealing crypto wallets, it replaces a wallet application with its infected version, allowing it to steal the secret phrase used to access cryptocurrency stored in compromised wallets.
The malware is designed to target macOS versions 13.6 and above, running on both Intel and Apple Silicon devices. Kaspersky highlighted the attackers’ ingenuity in hiding a Python script within a DNS server’s record, making the malware harder to detect in network traffic.
Security researcher Sergey Puzan from Kaspersky advised users with cryptocurrency wallets to exercise extra caution. Kaspersky recommends taking precautions such as keeping the computer’s operating system up to date, installing anti-malware software, and downloading apps only from official stores like the Apple App Store to safeguard digital investments.
While these measures enhance security, it’s crucial to remember that even hardware wallets are not immune to threats. In a separate incident, approximately $587,238 worth of Bitcoin was stolen after a fake Ledger cryptocurrency wallet management app was downloaded from the Microsoft App Store in November.
The threat to crypto wallets from malware continues to persist, with recent incidents underscoring the vulnerability of users and the potential for financial losses. Since November, over $4 million has been stolen through scams and fake airdrops on the Solana network.
Furthermore, hackers associated with North Korea’s Lazarus group reportedly stole over $35 million from users of Atomic Wallet, taking various cryptocurrencies such as USDT, XRP, Cardano, and Dogecoin. The Kaspersky report raises concerns, particularly for wallet providers like Exodus, Coinbase, and MetaMask, which have been targeted by hackers in the past.
JP Richardson, CEO of Exodus Wallet, emphasized the company’s commitment to customer security, conducting comprehensive code audits to identify and mitigate potential threats. Despite these efforts, Richardson recommends that users consider using a hardware wallet for an additional layer of security.