As MacOS Adoption Rises, the Malware Attacks Increase

The days in which Mac users could assume that they were operating one of the most secure OS in the market are over. Mac malware is on the rise and becoming more dangerous. Patrick Wardle, a researcher specializing in Apple security, recently concluded that new macOS malware specimens increased roughly 100% from 2022 to 2023, with ransomware, trojans, and backdoors being the top threats.

Following this trend, Bitdefender recently uncovered a new backdoor that shares similarities with the criminal groups BlackBasta and ALPHV/BlackCat. The new malware, Trojan.MAC.RustDoor has been hiding in the shadows,, running persistent attacks for the past three months, Bitdefender says.

Bogdan Botezatu, Director of Threat Research and Reporting at Bitdefender, spoke to Techopedia to explain why Apple users are in the cross hairs of cybercriminal gangs, and how bad actors are succeeding in breaching macOS systems.

“Macs have unfortunately become valuable targets because of their increased penetration in the enterprise. Some cybercrime groups are now attempting to carve a niche for themselves in the Mac space to move into other ecosystems because of fierce competition in the Windows landscape.”

Table of Contents Table of Contents

1. Key Takeaways
2. Why Are Criminal Gangs Going After Mac Users?
3. Latest Threats on MacOS
4. The New Mac Rust Backdoor
5. User Error and Hacking Tactics
6. Signs That The New Backdoor is Linked To BlackCat
7. The Most Common Form of Mac Trojans
8. Constant Security Patches and Zero-Day Exploits
9. Staying Safe from Trojans on a Mac
10. References

Show Full Guide

Table of Contents

1. Key Takeaways
2. Why Are Criminal Gangs Going After Mac Users?
3. Latest Threats on MacOS
Show Full Guide
4. The New Mac Rust Backdoor
5. User Error and Hacking Tactics
6. Signs That The New Backdoor is Linked To BlackCat
7. The Most Common Form of Mac Trojans
8. Constant Security Patches and Zero-Day Exploits
9. Staying Safe from Trojans on a Mac
10. References

Why Are Criminal Gangs Going After Mac Users?

Historically, the majority of malware has been mostly designed and coded to attack Windows OS. The reason for this is quite simple. Windows OS has been the most popular system in the world, holding above 70% of the global market share since 2013, as Statista reports. But over the same period, macOS adoption began to rise, especially in enterprises — where surveys suggest 22.4% of enterprise devices are MacOS.

Additionally, other factors are in play. Apple products have a mysticism about them. For example, Business Live research shows that more than half of those surveyed consider Apple devices “more expensive but worth the value“. Studies like these have been fueling a social perception that Mac users are high-value persons, attracting the interest of known cybergangs.

Latest Threats on MacOS

One of these gangs is the Lazarus Group — linked to North Korea — who last year launched a malware called KandyKorn targeting macOS users who worked in crypto and blockchain. Since then, several other new Mac malware have been spotted in the wild.

Now, Bitdefender presented evidence that strongly suggests that BlackBasta and BlackCat are also going into the Mac cyberattack market. Botezatu from Bitdefender explained to Techopedia why macOS malware is proliferating.

“As macOS has steadily gained ground in market share over the past few years, it has become much more attractive for cybercrime groups.

“‘Traditional’ macOS threats such as potentially unwanted apps (PUA) or aggressive adware have been surpassed in numbers by more devastating Trojans.”

The New Mac Rust Backdoor

Coded in Rust, a language that BlackCat has been using for years, the new Mac backdoor, discovered by Bitdefender, breaches into systems as a trojan. The attackers behind this campaign have created fake websites that lure potential victims into downloading a Mac update for Visual Studio — a popular software used to develop apps, web or desktop applications, and games.

Once victims download and install the malicious file, the installer creates a backdoor without the user ever knowing that his system has been breached and compromised.

This new malware is designed to steal files that are of specific extensions and sizes. It looks in the Documents and Desktop folders and on Notes, copies the files it wants to extract, then conceals them in a hidden folder and compresses them into a ZIP file, before finally sending them over to the attacker’s C2 server.

The installer runs an extraction with the sysctl command and the output of two other commands (pwd and hostname) to then submit them to the Register endpoint of the Control and Command server, and assign and receive a Victim ID.

Attackers use the Victim ID to communicate with the compromised macOS and then can take control of the computer remotely, gain information on the system, send and receive payloads, exchange information about tasks executed on the breached device, and steal files.

User Error and Hacking Tactics

Attackers are also leveraging the myths that users do not need Mac antivirus software?or are immune to malware.

The new Mac Rust backdoor attack, like other Mac attacks, can only be successful when Mac users visit malicious sites, do not check URLs, down software, files or apps from unverified sites, but once that has happened, they are free to operate without a second layer of security such as a trusted and professional anti-malware running in the background.

Even savvy users can be tricked into downloading and executing an infected file. For example, the Mac AMOS stealer recently updated itself pretending to be Slack, and the recent Trojan.MAC.RustDoor impersonates an update for Visual Studio. Criminals will continue using this tactic as long as they continue getting results. And Mac users’ security awareness can influence those results.

Signs That The New Backdoor is Linked To BlackCat

Bitdefender’s digital forensics shows that the Trojan.MAC.RustDoor is a new undocumented family of malware. However, despite not confidently attributing it to any known threat actors, the security company says several factors signal to BlackCat.

First of all, as mentioned, the backdoor is coded in Rust, a programming language used by BlackCat. Additionally, three out of the four command and control servers were previously associated with ransomware campaigns targeting Windows clients, BitDefender said.

Malware coded in Rust is stealthy and very evasive as the coding language is relatively new, and Rust security tools are not as adopted as other tools for other languages.

Unlike Python, which uses interpreters, Rust compiles directly to machine code, obscuring its intent.

BitDefender says that they have already discovered several different versions of the new backdoor.

Botezatu shared with Techopedia Bitdefender’s latest macOS Threat Landscape Report, adding:

“Apple finds itself consistently having to patch actively exploited vulnerabilities as threat actors employ social engineering vectors and spray-and-pray techniques,”

The Most Common Form of Mac Trojans

Constant Security Patches and Zero-Day Exploits

In the past six months, Apple has released over 60 security releases for all its devices — including Macs, iPhones, iPads, and the Apple Watch. Twenty-eight of those security patches were released in the past three months, some of these rushed to patch critical security vulnerabilities as new OSs were rolled out.

The rate of modern software development, app releases, and updates is fast-paced, and security patches are not uncommon. They affect all software companies, not just Apple. However, for cybercriminals, new software and OS are a golden opportunity to exploit, and zero-day exploits are trending in the underground criminal world.

The report adds that black hat hackers are not just exploiting zero-day vulnerabilities but also users’ lax cybersecurity hygiene. Whether it be a trojan, a crypto jacker, a backdoor, or a ransomware attack on Mac, they are all triggered by human error.

Staying Safe from Trojans on a Mac

As worrying as the new wave of malware coded for Mac environments are, there are still several things users can do to keep secure.

Bitdefender’s report explains that malware such as trojans, which exploit unpatched vulnerabilities, are particularly dangerous for users who postpone installing Apple’s latest security patch. Therefore, keeping a Mac up to date is critical for its security.

Paying close attention to the URLs when visiting unknown sites is also important. Furthermore, all downloads should be done through legitimate and trusted sites. Users also need to be aware of the latest trends and techniques used by cybercriminals as they are constantly innovating and finding new ways to trick users.

Another technique that is gaining popularity is the use of fake ads on popular search engines like Google that criminals use to redirect victims to malicious phishing sites. Setting browser settings to the highest security levels and not ignoring a warning when a site is flagged as malicious is also important.

Finally, scanning a Mac regularly and investing in additional professional security always goes a long way.