{"id":186160,"date":"2021-02-22T17:29:48","date_gmt":"2021-02-22T14:29:48","guid":{"rendered":"https:\/\/en.buradabiliyorum.com\/alarming-macos-malware-found-on-over-30k-machines-including-m1-macs-review-geek\/"},"modified":"2021-02-22T17:29:48","modified_gmt":"2021-02-22T14:29:48","slug":"alarming-macos-malware-found-on-over-30k-machines-including-m1-macs-review-geek","status":"publish","type":"post","link":"https:\/\/buradabiliyorum.com\/en\/alarming-macos-malware-found-on-over-30k-machines-including-m1-macs-review-geek\/","title":{"rendered":"#Alarming macOS Malware Found on Over 30k Machines (Including M1 Macs) \u2013 Review Geek"},"content":{"rendered":"

“#Alarming macOS Malware Found on Over 30k Machines (Including M1 Macs) \u2013 Review Geek”<\/strong><\/p>\n

\n
\"A
canadianphotographer56\/Shutterstock<\/a><\/span><\/figcaption><\/figure>\n

Security researchers at Red Canary<\/a> have discovered a mysterious new malware on nearly 30,000 Macs, though the actual number of infected computers is probably much higher. It app<\/a>ears that the malware, nicknamed Silver Sparrow, is waiting for the right moment to deliver a malicious payload to its host devices. It\u2019s one of the first viruses to run natively on both Intel and M1 Macs.<\/p>\n

Silver Sparrow hasn\u2019t harmed any computers yet, but it checks a control server for new commands every hour. Without access to this control server, we have no way of knowing the goal behind Silver Sparrow. That said, the fact that someone is waiting to \u201cactivate\u201d the malware is alarming.<\/p>\n

\"A
Red Canary<\/a><\/span><\/figcaption><\/figure>\n

Another alarming factor is Silver Sparrow\u2019s unique, ingenious design. It\u2019s distributed in two unique packages, titled updater.pkg<\/code> and update.pkg<\/code>. While macOS malware usually relies on preinstall or postinstall scripts to execute commands, these packages execute commands through the less-transparent JavaScript API. Of all the malware that Red Canary has encountered, it says that Silver Sparrow is the only one to leverage the JavaScript API.<\/p>\n

Upon installation, Silver Sparrow looks up the URL that it was downloaded from, probably to help its designers track which infection methods are the most effective. Interestingly, Silver Sparrow relies on AWS S3 and Akamai CDN cloud services for file distribution, which suggests that its designers are experienced with web servers and cloud computing. Cloud distribution is more resilient than single-server distribution methods, and using popular cloud infrastructure like AWS allows the malware designers to \u201cblend in\u201d with regular web traffic.<\/p>\n

Red Canary teamed up with MalwareBytes and found the Silver Sparrow virus on nearly 30,000 computers. Of course, this is just the number of infected computers that MalwareBytes has access to, the actual number of infected computers is probably much higher. Scroll to the bottom of Red Canary\u2019s report<\/a> if you want to hunt for Silver Sparrow on your Mac, or use the MalwareBytes antivirus software<\/a> to scan your computer for the virus.<\/p>\n

Source: Red Canary<\/a> via Ars Technica<\/a><\/small>\n<\/div>\n