Roger Fingas
Newly-discovered Mac malware is geared toward stealing browser cookies for cryptocurrency exchanges such as Coinbase and Bittrex, security researchers say.
The code is based on "OSX.DarthMiner," uncovered in late 2018, members of Palo Alto Networks' Unit 42 reported on Thursday. Some other targeted exchanges include the likes of Binance, Poloniex, Bitstamp, and MyEtherWallet.
It also attempts to steal text messages from iTunes backups, and passwords and credit cards saved in Chrome — but not in Safari. In some cases the combination of data could even let attackers bypass two-factor authentication at cryptocurrency sites, normally a strong deterrent.
Compounding problems, the new malware — nicknamed "CookieMiner" — will install covert coin mining software that consumes a Mac's system resources. The app is apparently geared toward mining "Koto," a privacy-oriented Japanese cryptocurrency.
CookieMiner's creators can execute remote controls, and the code is smart enough to check if if Objective Development's Little Snitch firewall app is active, halting the remote access agent to avoid detection.
Customers of Palo Alto Networks' WildFire technology are already protected from the threat. It's not certain whether Apple has been alerted or taken action.
In the interim worried Mac users concerned about this vector of attack may want to avoid saving credentials in the Keychain and not directly in a browser, and/or scrub browser caches on a regular basis.
AppleInsider Staff
Malcolm Owen
Oliver Haslam
Andrew O'Hara
Wesley Hilliard
William Gallagher
Christine McKee
9 Comments
Little iSnitch is quite interesting.
I know this is trivial but that headline image of an iPhone leading into a macOS article seems wrong to me.
This is why I maintain a completely separate financial computer that ONLY does finances and ONLY accesses known financial sites that I do business with. In addition to using InPrivate browsing I delete all cookies after each use and never store IDs or passwords on the machine. It also uses ethernet instead of WiFi to avoid the chance of a random Google mapping car scooping up my WiFi data.
Admittedly, it's overkill and it doesn't even guarantee safety, but increases the odds...
Jeeze! That sounds nasty.