Threats Tagged 'xmrig cryptominer'

This macOS malware campaign uses social engineering via fake CAPTCHA pages to trick victims into running malicious AppleScript commands. It installs a persistent backdoor that leverages EtherHiding by storing command-and-control (C2) addresses in Polygon blockchain smart contracts, complicating detection. The malware maintains persistence through LaunchAgents and deploys multiple payloads, including the AMOS stealer targeting cryptocurrency wallets, browser credentials, and macOS Keychain data, as well as the XMRig cryptominer for ongoing revenue. The campaign employs advanced evasion techniques such as character-ID obfuscation and abuse of legitimate macOS utilities. Blockchain transaction analysis provides defenders with insights into C2 infrastructure despite the malware's memory-resident execution model.