New XLoader malware steals credentials from macOS and Windows

Check Point experts talked about a new cross-platform malware XLoader, asubscriptionto which costs only $49 on the darknet. XLoader provides the opportunity to collect credentials, can act as a keylogger and runs malicious files.

XLoader originated from the well-known Formbook malware family, which mainly attacked Windows users, but disappeared from the market in 2018. In 2020, Formbook was renamed XLoader.

New XLoader malware

XLoader was first spotted last February and has gained popularity by promoting it as a cross-platform (Windows and macOS) botnet with no dependencies. The connection between the two malwares was established after it was discovered that the new malware uses the same executable file as the Formbook earlier. Then the malware vendor explained that the Formbook developer had really contributed a lot to the creation of XLoader. Because of this, malware has very similar functionality (stealing credentials, taking screenshots, keylogging, and executing malicious files).

Looking at XLoader activity over the past six months, Check Point analysts found that it now targets not only Windows users, but macOS users as well. You can “rent” the version for macOS for $49 a month, having access to a server provided by the seller. By maintaining a centralized management infrastructure, malware authors can control how their clients use XLoader.

The Windows version is more expensive, as for it the the seller asks for $59 per month, 或 $129 for three months.

如上所述, researchers tracked Xloader activity from December 1, 2020 to June 1, 2021, and during this time they recorded requests to buy XLoader from hackers from 69 countries. 此外, more than half (53%) of malware victims live in the United States.

XLoader is much more sophisticated than its predecessors, and it supports various operating systems, in particular macOS. Historically, macOS threats have not been widespread: they were generally spyware and did not cause too much damage. I think there is a common misconception among macOS users that Apple is more secure than others. Previously, we could say that there was a gap between malware for Windows and macOS, but now it is gradually narrowing. Malware for macOS is becoming more and more dangerous and widespread. Our recent research confirms this trend. Cybercriminals are increasingly interested in the macOS platformand personally, I expect to see more cyber threats very soon. The Formbook family is just the beginning. Therefore, I would think twice before opening attachments from emails that I receive from unknown senders.Yaniv Balmas, Head of Cyber Research at Check Point Software, 說.

Let me remind you that I also wrote that Researchers discovered Siloscape malware targeting Windows Server containers and Kubernetes clusters.

黑尔加·史密斯

我一直對電腦科學感興趣, 尤其是數據安全和主題, 而家被稱為 "數據科學", 由我十幾歲開始. 在進入病毒清除團隊擔任主編之前, 我曾喺多傢公司擔任網絡安全專家, 包括亞馬遜嘅承包商之一. 另一種體驗: 我在雅頓大學同雷丁大學任教.

留言

本網站使用Akismet嚟減垃圾郵件. 瞭解如何處理評論數據.

“返回頂部”按鈕