Cybercriminals Are Increasingly Attacking Macos

[✨ Megiddo]

It is generally accepted that Apple software products are safer than the rest, however, as telemetry data for the first half of 2019 show, the apple ecosystem is definitely interested in cybercriminals.

According to Kaspersky Lab, the number of cyber attacks on macOS using malware and unwanted software has been increasing annually since 2012. In 2018, the number of attacks increased to 4 million, and in the first half of 2019, LK specialists recorded 1.8 million cyber attacks on macOS using malware.

Most often, in attacks on “poppies”, cybercriminals use the Shlayer downloader, which loads adware (mainly the Bnodlero family) onto a compromised system. As a rule, malware enters the computer through pirated sites offering to watch or download popular films and TV shows for free. To view the content, the resource offers to “update” Flash Player, and under the guise of updating the system, Shlayer is loaded.

The remaining threats from the top 10 most common are unwanted and adware that display ads in system notifications, banners on web pages, on search results pages, in a browser, etc.

In second place after Shlayer is adware Bnodlero, which installs extensions in the browser, changing the default search engine and home page. Pirrit adware goes even further and installs a proxy server on a compromised computer to intercept browser traffic. Cimpli, in turn, uses sophisticated detection bypass techniques, for example, it becomes inactive if it detects installed security solutions on macOS.

In the first half of this year, macOS attacked the Spynion and Vidsler families of malware. The Spynion Trojan is distributed through free programs offered on sites such as MacUpdate, VersionTracker and Softpedia. The malware allows attackers to monitor user activity and gain access to a compromised system. Vidsler is distributed through banner ads and links and is similar in functionality to Spynion.

In addition to malware, Kaspersky Lab experts recorded about 6 million phishing attacks on macOS users this year, of which 11.8% were corporate users. More often than not, victims are “bought” on phishing pages faked as pages of banking services.