Threats Tagged 'atomic stealer'

A deceptive website impersonating CleanMyMac tricks users into installing SHub Stealer, a sophisticated macOS malware. The malware steals sensitive data, including passwords, browser data, cryptocurrency wallets, and Telegram sessions. It can also modify wallet apps to steal recovery phrases. The attack begins with users pasting a command into Terminal, which downloads and executes a malicious script. The malware performs extensive data collection from various browsers and wallet applications, and installs persistent backdoors in certain crypto wallet apps. SHub Stealer is part of a growing family of AppleScript-based macOS infostealers, demonstrating increasing sophistication in targeting Mac users.

MediumMalwareUnited StatesCanadaUnited Kingdom+7#browser data theft#clickfix#applescript

An ongoing social engineering campaign is targeting cryptocurrency users through fake startup companies impersonating AI, gaming, and Web3 firms. The scammers create elaborate facades using spoofed social media accounts and project documentation on platforms like Notion and GitHub. They contact victims offering to pay them to test software, which is actually malware designed to steal crypto wallet contents. The campaign uses both Windows and macOS malware, including information stealers like Atomic Stealer. The threat actors go to great lengths to appear legitimate, even creating fake conference photos and merchandise stores. Multiple fake company identities have been identified as part of this campaign.

MediumMalwareUnited KingdomGermanyFrance+4#impersonation#social engineering#malware