New threat for Mac users: MetaStealer malware targets macOS

Mac owners are facing a new threat in the form of MetaStealer malware, discovered by SentinelOne cyber security researchers. This malware belongs to the category of 'infostealers', designed to steal sensitive information such as passwords and credit card details from infected computers.

The hackers behind MetaStealer have mainly targeted businesses, posing as potential customers. They convince their victims to download and install a .dmg file, a disk image containing a malicious application. To disguise their intentions, the hackers have misleadingly named these files, using names such as "advertising reference clauses (MacOS presentation).dmg" or "CONCEPT A3 menu complete with dishes and English translations.dmg".

Once installed, the malware persuades the user to bypass GateKeeper, macOS' built-in protection against insecure applications. This allows the malware to install itself unhindered. Although GateKeeper normally checks the origin of applications and blocks those from unauthorised sources, users can change these settings to allow applications from unapproved sources to be installed.

It is important to note that MetaStealer mainly targets Macs equipped with Intel processors, while recent Macs powered by Apple Silicon chips (M1 or M2) are not directly affected. However, to infect a Mac with an M1 or M2 chip, MetaStealer would have to go through Rosetta, an emulation tool for running Intel applications on Apple's new ARM processors.

The hackers also used code obfuscation to make the malware difficult to detect by anti-virus software. This technique scrambles the software's code, masking its data exfiltration functions.

MetaStealer is not the only malware to threaten Mac users recently. Other threats, such as Atomic Stealer and ShadowVault, have also been reported. This growing trend of targeting Mac users to steal their data highlights the importance of installing anti-virus software on your macOS devices to protect against potential threats.