- Researchers from Proofpoint observe two groups participating in “False Updates” attack
- The groups have their separate tasks against macOS units
- The goal is to distribute Frigidtealer, a new infoTealer -Malware
Cyber criminals use fake macOS updates to distribute a new piece of malware called frigid teals, new research has claimed.
CyberSecurity scientists Proofpoint recently observed two new threat actors distributing malware, tracked as TA2726 and TA2727, which worked together on different parts of the same campaign to get macOS users to install freedom tea.
The selected distribution method “Fake Update” where the victims would visit a compromised site that would earn a popup. This popup would warn users that they had to update either their Macs or their browsers to view the content of the site.
Targeting Windows, Linux, MacOS and Android
Instead of an actual update, the victims would download and run the installation program for Frigidtealer Malware, which did what infosteals usually do -it steals information, including browser cookies, files containing passwords or cryptocurrency -related data, files from Apple Notes and similar.
The chair data is stored in the user’s home catalog before being sent to the striker’s command and control (C2) Server: Askforupdate[.]org.
Proofpoint says malware is distributed by TA2727, an economically motivated cyber criminal group. On the other hand, TA2726 acts as a Traffic Distribution System (TDS) operator who redirects web traffic to TA2727’s payload.
The majority of the goals appear to be located in North America and Europe, and in addition to frigidteals, Crooks also uses Lumma Stealer and Desteals for Windows targets and Marcher Banking Trojan for Android users.
False update attacks are nothing new they have been around for years. The Socgholish Malware campaign attributed to the threat actor TA569 is recognized as one of the most productive users of these attacks. Socgholish is active since at least April 2018, and employs malicious malicious JavaScript injected into compromised sites to present visitors with misleading requests for software updates, such as fake browser or flash player updates.
