Mac M1 malware : Silver Sparrow

[Alex5723]

Clipping Silver Sparrow’s wings: Outing macOS malware before it takes flight

Silver Sparrow is an activity cluster that includes a binary compiled to run on Apple’s new M1 chips but lacks one very important feature: a payload.

Earlier this month, Red Canary detection engineers Wes Hurd and Jason Killam came across a strain of macOS malware using a LaunchAgent to establish persistence. Nothing new there. However, our investigation almost immediately revealed that this malware, whatever it was, did not exhibit the behaviors that we’ve come to expect from the usual adware that so often targets macOS systems. The novelty of this downloader arises primarily from the way it uses JavaScript for execution—something we hadn’t previously encountered in other macOS malware—and the emergence of a related binary compiled for Apple’s new M1 ARM64 architecture.

..we quickly realized that we were dealing with what appeared to be a previously undetected strain of malware…

1 user thanked author for this post.

rodcallen

Reply | Quote

[anonymous]

? says:

thank you, Alex. made the local news this morning, so it must be taking root…

Reply | Quote

[Alex5723]

anonymous wrote:

? says:

thank you, Alex. made the local news this morning, so it must be taking root…

30,000 infected Macs found so far.

Apple has informed MacRumors that it has revoked the certificates of the developer accounts used to sign the packages, preventing additional Macs from being infected. Apple also reiterated that Red Canary found no evidence to suggest the malware has delivered a malicious payload to Macs that have already been infected..

• This reply was modified 1 week, 4 days ago by Alex5723.

1 user thanked author for this post.

rodcallen

Reply | Quote

[Author]

Posts