Fake iTerm2 Website Spreads the OSX.ZuRu Malware
While most cybercriminals continue to heavily target Windows machines, there are bolder groups out there who go more exotic targets – like macOS systems. The OSX.ZuRu is one of the latest identified malware to go after Macs exclusively. Its creators appear to be relying on sponsored search result listing to try and refer users to a malicious page. The criminals are actually spoofing the name of a legitimate macOS tool called iTerm2. It is official website is iTerm2.com, but the criminals are hosting a fake version on iTerm2.net. The second page is designed to look exactly like the original one. Because of the use of sponsored search results, users searching for iTerm2 may accidentally lend on the fake website by mistake.
Currently, the criminals appear to only target the Chinese Baidu search engine. However, it would not be a surprise if they tried to expand their operation in the near future. Once a user tries to download iTerm from the fake website, they will be referred to a 3rd-party hosting service, which fetches the file iTerm.dmg. So far, on the user's screen everything looks normal – the only noticeable red flag is the slightly different domain name. However, most people would not notice this.
But this is far from everything that the crooks have done to hide their malicious activity. Once a user executes and installs the suspicious iTerm.dmg app, they will end up getting access to a copycat of the iTerm shell. In fact, it appears to work just like the original. However, it will also execute malicious code in the background, where the real magic happens.
What does OSX.ZuRu Do?
The first step that this malware takes is to connect to a remote Web application and send some data about the victim. The primary piece of information it sends is the serial number of the device. After this, it tries to establish a second connection to a malicious Web server. The latter is the dangerous part – it can deliver a long list of payloads. These hidden downloads often bear the names of legitimate apps and services – e.g., Google Update.
One of the payloads appears to be a script that exfiltrates certain data from the infected system – keychain, hosts file, bash history, folder names, etc. The other one appears to be a copy of the Cobalt Strike Beacon. This is a security penetration framework that cybercriminals sometimes use.
Clearly, cybercriminals are experimenting with all sorts of nasty tricks to reach their victims. The OSX.ZuRu campaign, in particular, is very intriguing in this manner. The best way to keep your system and data safe is to use antivirus software.
