MalwarePublished 29 Aug 2025Updated 1 Sep 2025

New Mac malware identified that evades detection through fake PDF conversion tool

Source AlienVault OTX General

Description

Mosyle has discovered a new Mac malware strain called 'JSCoreRunner' that evades detection by masquerading as a PDF conversion tool. The malware spreads through a malicious website, fileripple.com, and operates in two stages. The first stage, FileRipple.pkg, appears as a legitimate PDF tool while running malicious code in the background. The second stage, Safari14.1.2MojaveAuto.pkg, bypasses Gatekeeper's protections. Once installed, JSCoreRunner targets Chrome browsers, altering search engine settings to redirect users to fraudulent providers. This exposes users to keylogging, phishing, and potential data theft. The malware's sophisticated approach highlights the need for vigilance and proactive security measures for Mac administrators.

Impact

For European organizations, the JSCoreRunner malware poses a significant risk primarily to Mac users, particularly those using Google Chrome browsers. The malware’s ability to hijack browser settings and redirect users to fraudulent sites exposes organizations to credential theft, espionage, and data exfiltration risks. This can lead to compromised employee accounts, unauthorized access to corporate resources, and potential financial fraud. The stealthy nature of the infection, including bypassing Gatekeeper and masquerading as legitimate software, increases the likelihood of successful infiltration, especially in environments where Mac endpoint security is less mature or where users have elevated privileges. Given the increasing adoption of Mac devices in European enterprises and public sector organizations, the threat could disrupt operations, damage reputations, and lead to regulatory compliance issues under GDPR if personal data is compromised. The phishing and keylogging capabilities further amplify the risk of lateral movement within networks and broader compromise.

Defensive guidance

European organizations should implement a multi-layered defense strategy tailored to this threat: 1) Enforce strict application whitelisting and restrict installation of software from untrusted sources, particularly monitoring for packages like FileRipple.pkg and Safari14.1.2MojaveAuto.pkg. 2) Enhance endpoint detection capabilities with behavioral analysis focused on unusual browser configuration changes and Gatekeeper bypass attempts. 3) Deploy network-level protections to block access to known malicious domains such as fileripple.com and monitor DNS queries for suspicious redirections. 4) Educate users about the risks of downloading software from unofficial websites and the dangers of fake utility tools. 5) Regularly audit Chrome browser settings across enterprise devices to detect unauthorized modifications. 6) Apply the latest macOS security updates and consider deploying advanced endpoint protection solutions capable of detecting zero-day evasion techniques. 7) Implement strong multi-factor authentication to mitigate the impact of credential theft. 8) Maintain incident response plans that include forensic analysis of Mac endpoints to quickly identify and remediate infections.

Indicators of compromise

Domains 1

fileripple.com

Hashes 10

6e36f4e2cdbdd81f3e8ccf4c37febf8c
99d4af55076a6e248058ea11ac80abf689bf547d
23186719325c87eb4e17aae0db502e78fb24598e97c8a9c151d7c347e72c0331
35c64a2111c0b8e728ee82db3d727319720e612e9a3dfe85d445f5b90fc1485a
3634d1333e958412814806a5d65f1d82536d94cac21ec44b8aba137921ae3709
5828ab3abf72c93838a03fb5a9ca271ddbb66ad4b3a950668a22cd8f37ac9b04
6c5e51e7aeb1836d801424f20ffd56734cdc35a75ae3cca88002f94c40949a27
84f8e3f996cf907f71ee4823c1bc91a82589c5e4fcd98a9084e51b02ad3515dd
a7a02c6f5073133added3bfc9c67ca385168ba35469752fcddf5e1ed5fcef1ce
a86fe93e1a4c451c11b628f622b80770f40254de4a050bbe8e4caae7ef89dfa4

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 1 Sep 2025, 09:03 UTC

MITRE ATT&CK techniques10 from threat tags

Technical details

Indicators of compromise

Domains 1

Hashes 10

Community reviews

Related threats