The Rising Threat: Exploring the Implications of ‘MetaStealer’ Malware Targeting Businesses

Malware & Threats: macOS Info-Stealer Malware ‘MetaStealer‘ Targeting Businesses

A recently identified macOS information stealer called MetaStealer has been targeting businesses to exfiltrate keychain and other valuable information, according to cybersecurity firm SentinelOne. The malware, written in Go and highly obfuscated, can steal files, harvest saved passwords, and exfiltrate the keychain, a storage facility on macOS that securely stores passwords, certificates, and other sensitive information. Additionally, MetaStealer contains methods to target popular messaging applications like Telegram and Meta.

A New Modus Operandi: Posing as Clients

What sets MetaStealer apart from other information stealers is that its operators pose as clients to trick business employees into executing their malicious payload. The malware is being distributed as malicious application bundles within disk image files (.dmg) bearing names that are tailored to appeal to business users. The names of these disk image droppers are designed to lure recipients into executing them.

One user reported being targeted by someone posing as a design client, who sent a password protected zip file containing a DMG file. The user uploaded the MetaStealer sample to VirusTotal, a free malware analysis service.

Rising Threat to Business Users

Historically, macOS malware has been distributed primarily through torrent sites or cracked versions of legitimate software and has rarely targeted business users specifically. However, MetaStealer‘s focus on businesses signifies an evolving threat landscape. The high-value data targeted by this information stealer could allow attackers to gain a foothold in targeted organizations’ networks or be used for other malicious activities.

Challenges for macOS Security Mechanisms

MetaStealer‘s samples do not have a code signature attached, and they do not use ad hoc signing. This means that the attackers need to trick the intended victim into overriding existing macOS protections, including Gatekeeper, which is designed to block unsigned or untrusted applications from running on macOS. The fact that some MetaStealer samples remain undetected even after Apple’s recent update to its malware blocking tool, XProtect, highlights the challenge of staying ahead of sophisticated malware.

Link to Atomic Stealer and Attribution Challenges

SentinelOne has identified a link between MetaStealer and the Go-written Atomic Stealer, another information stealer. However, there are very few code overlaps between the two malware families. It is unclear whether the same team of malware developers is behind both stealers or if different individuals or teams are using similar techniques to achieve the same objectives. Attribution in the world of malware is notoriously challenging, making it difficult to definitively connect different attacks to specific threat actors or groups.

Implications and Analysis

The emergence of MetaStealer highlights the increasing sophistication and evolving modus operandi of malware targeting businesses. By posing as clients, attackers are capitalizing on the trust between businesses and their clients, making it harder for employees to detect suspicious behavior. The fact that MetaStealer targets the keychain, which contains sensitive information that could enable broader network access for attackers, underscores the urgency for businesses to strengthen their cybersecurity defenses.

The challenges posed by MetaStealer also shed light on the limitations of existing macOS security mechanisms. Despite Apple’s efforts to update its malware blocking tool, some MetaStealer samples manage to evade detection, indicating the need for constant vigilance and proactive measures to counter emerging threats.

Furthermore, the potential link between MetaStealer and Atomic Stealer raises questions about attribution and the complexity of the malware landscape. Malware developers employ various techniques to obfuscate their identities and distribute their creations, making it difficult for security researchers to identify and track specific threat actors.

Advice for Businesses:

Given the evolving threat landscape, businesses should take the following steps to strengthen their cybersecurity defenses:

1. Educate Employees:

Train employees to be cautious when downloading or executing files from unknown or suspicious sources. Emphasize the importance of verifying the authenticity of email senders or clients by using separate communication channels, such as phone calls or official company email addresses.

2. Implement Strong Access Controls:

Leverage multi-factor authentication (MFA) and strong password policies to protect critical accounts and systems. Ensure that employees use unique passwords for each application or platform and regularly update them.

3. Regularly Update and Patch:

Maintain up-to-date operating systems and software, including antivirus and malware protection solutions. Promptly apply patches and updates to mitigate vulnerabilities that attackers may exploit.

4. Monitor and Detect:

Invest in cybersecurity solutions that provide real-time monitoring and detection capabilities. Implement comprehensive security information and event management (SIEM) tools to identify and respond to potential threats promptly.

5. Conduct Regular Security Audits:

Perform periodic cybersecurity assessments and penetration testing to identify potential vulnerabilities in your infrastructure. This will help you proactively address any security gaps and strengthen your defenses.

6. Collaborate and Share Threat Intelligence:

Participate in information sharing initiatives within your industry or with trusted partners to exchange insights and best practices on emerging threats and effective defense strategies.

In conclusion, the emergence of MetaStealer reinforces the need for businesses to prioritize cybersecurity and take proactive measures to protect sensitive information. By staying informed about evolving threat landscapes and following best practices, businesses can enhance their resilience against sophisticated malware attacks.