Crypto Exchange Infected With Novel Mac Malware
A group of researchers has made a groundbreaking discovery by uncovering previously unknown Mac malware that has infected a cryptocurrency exchange. This malicious software, known as JokerSpy, possesses a comprehensive range of capabilities, enabling it to pilfer private data, as well as download and execute additional harmful files.
JokerSpy, written in the Python programming language, exploits a freely available tool called SwiftBelt, typically utilized by legitimate security professionals for assessing network vulnerabilities. The security company Bitdefender initially brought JokerSpy to the public's attention earlier this month. Analysts from the company indicated that the malware includes components for both Windows and Linux, suggesting that versions for these platforms may also exist.
Following this revelation, Elastic, another security firm, reported that their diagnostic endpoint protection tool had detected a binary file named xcc, which is associated with JokerSpy. Although Elastic did not disclose the exact identity of the victim, they did mention that it was a prominent cryptocurrency exchange based in Japan.
Malware's mode of operation
Once xcc is executed, the unidentified threat actor attempts to circumvent macOS's TCC (Transparency Consent and Control) protections, which mandate explicit user permission for an application to access sensitive resources such as the hard drive, contacts, or screen recording.
By substituting the legitimate TCC database with their own version, the threat actors likely intended to suppress any alerts that would typically arise when JokerSpy is operational. Previous attacks have demonstrated the ability of threat actors to exploit vulnerabilities in TCC protections for bypassing them. These manipulations have been successful in similar instances.
Despite extensive investigation, researchers have yet to determine the precise method of JokerSpy's installation. Elastic researchers strongly believe that the initial access point for this malware was a malicious or compromised plugin or third-party dependency that granted the threat actor unauthorized entry. This hypothesis aligns with findings from Bitdefender, as they connected a hardcoded domain discovered in a version of the sh.py backdoor to a series of tweets regarding an infected macOS QR code reader containing a malicious dependency. Elastic also noted that the observed threat actor already had pre-existing access to the Japanese cryptocurrency exchange.
