If you still believe the misconception that Macs are immune to viruses, you better think again,
because there is yet another brand new strain of malware on Macs, and it's called the Atomic macOS
Stealer, and it just came out very recently. Now, Macs are not more inherently secure than
Windows. They haven't ever been, but for a long time, you really never got viruses on Macs just
because they had such a small market share that it was way more worth it to make a virus for Windows.
But I would think that that might actually make them a juicy target depending on how
you look at it, because you could consider Mac users to have their guard down if they're
not expecting to get them very often. Anyway, back to the virus. Of course,
this is not the only virus that's on Mac, but this is interesting because
it is a apparently brand new strain, like custom made by whoever wrote this virus.
And you'll see a bunch of articles written about it recently, but I'm all about primary sources,
or that's a fancy term for going back to the original source. In this case,
it's a cybersecurity research firm called Cyble, and most of the info I'll be mentioning in this
video comes directly from their blog post, which I'll put a link in the description.
Quick clarification, it actually seems that this virus was first spotted by
someone on Twitter called PhD. Phuc, but it was Cyble that was the first ones to find the
advertisement on Telegram from the creator of the virus. So I just wanted to point that out.
They discovered this malware in a Telegram group, that's how it was being advertised,
and apparently the person who created it is charging $1,000 a month to use it.
So malware creators are not just in the game of writing malware and distributing it,
they basically sell it as a subscription, kind of like affiliate programs. So times
have really changed. Gone are the days where when you got a virus,
the main thing you had to worry about was getting some pop-up ads.
Now you have to worry about them stealing your entire hard drive's worth of data
and encrypting it and stealing money. It's wild. And the capabilities of this Atomic
Mac OS stealer are very severe. Notably, it will be able to steal the entire keychain
of your Apple account, which is devastating to someone who
stores all their passwords on there and uses it as a password manager.
They literally would be able to get access to all of your accounts. And especially considering
that the keychain recently added the ability to store two-factor authentication tokens,
the rotating codes. So if someone uses that, I mean, you have no defense left.
It also steals information about the system, files from the desktop and documents folder.
It'll steal the Mac OS password through phishing. It will steal from web browsers.
So any cookies you have, any auto-fill settings, passwords on the browser,
crypto wallet extensions, credit cards, everything from there. And if you have any
standalone cryptocurrency wallets on your computer, it will steal from 60 of those.
And it also has a bunch of other "features" (I guess what else would you call them) about being
able to control this virus for the person using it. Though I'll go over a little bit
more in detail about what the virus does when you actually run it in a second. At the time
when Cyblel found this virus, it was completely undetected on virus total.
So no one was detecting it. Now of course if you run it through, it does get detected by
most of the big ones. Fortunately though, the way to avoid this virus is nothing
special. It's the usual best practices. So only [download] from reputable sites,
double check it. If you can, download from the Mac store, they say, if possible,
not everything's on the Mac store. But if it's not, double check where it's coming from.
And also use biometric authentication if you can, if possible, because as you'll see, the
way they steal the Mac OS password is simply by phishing it, nothing new. So let's go into detail
about how it actually works. So when you download the file, it'll be a DMG file, which is a typical
Mac software installer type file, and it'll be impersonating some other type of download.
So who knows how this will be distributed. Like I said,
it's kind of like a subscription affiliate program. So whoever buys it can distribute
it whatever way they want. But at the moment it has been spotted being uploaded to virus total
under a few names, such as Notion, a note-taking app, Photoshop, Tor browser.
So clearly it's going out in the wild as various different softwares being impersonated. When you
run it, it pops up some very nice looking instructions, I guess you could say,
nothing really out of the ordinary. This is kind of typical from my understanding
of Macs. Then immediately after it will pop up a fake password prompt saying that you need to be
able to access the system settings to install it or whatever, but this whole thing is fake.
And then it'll literally just steal your Mac OS password. And then of
course it can use that to do pretty much whatever it wants. For example,
that's how it goes and access the keychain. And at that point you literally have all your
passwords stolen. So you're kind of screwed. The next thing it does is looks for a list of
hard-coded cryptocurrency software, and I guess copies everything it can from there.
I believe it tries to brute force seeds. I don't know how realistic that is. And then it goes for
any cryptocurrency browser extensions as well. After that, it goes through a whole
bunch of possible browsers and looks in the standard installation locations for those.
And of course again, steals your cookies so they can bypass two-factor authentication.
If you're not familiar with cookie hijacking and session hijacking, once they steal your cookies,
they simply clone your browser and they don't even have to type in your password or two-factor
authentication. They're already logged in when they do that. So definitely devastating. And
when it goes to steal documents specifically from the desktop and documents directories,
it looks like it does have to pop up and get the user to authenticate to access those.
So it'll say set up once to access the desktop or documents. So I mean,
I guess that's one thing that it still requires authentication. But I think at that point,
if the user already typed in their password, they're probably going
to click to accept it. So really they have everything they want at that point.
So at that point, not much more to say about what happens. All your info gets sent back to
the malicious software distributor and they have everything. So yeah,
just kind of a cool case study on a brand new strain of Mac viruses. So
if you weren't aware that this kind of thing was possible, definitely understand now that
you really have to be on your guard no matter what kind of computer you're using.
But let me know in the comments, if any of you are Mac users, and maybe you admit to yourself,
you've been a bit too comfortable when it comes to your security practices, and now you'll be
stepping it up. If you enjoyed this video, give it a big thumbs up for my YouTube algorithm overlord.
And if you enjoyed this video, the next video I'd recommend is where I was talking about a
bunch of hidden features in Microsoft Word that are very useful, but not many people know about.
I think you'll find that really interesting. It applies for both
Windows and Mac. So hope you enjoyed this video. Let me know what you think down in
the comments. Thanks for watching, and I'll see you in the next one.