Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Mac Malware Steals Cryptocurrency Exchanges’ Cookies

Summary: Unit 42 discovered Mac malware, named CookieMiner and believed derived from OSX.DarthMiner, that steals Safari cookies for exchanges including Binance, Coinbase, Poloniex, Bittrex, Bitstamp and MyEtherWallet, extracts saved Chrome passwords and credit card data, and pulls iPhone text messages from iTunes backups on the tethered Mac. The malware also installs a coinminer labeled xmrig2 that actually mines Koto rather than Monero, and downloads an EmPyre post-exploitation agent from hxxps://ptpb[.]pw/OAZG that exits if Little Snitch is running.

Key Takeaway: Combining stolen credentials, cookies and SMS is what lets attackers slip past multi-factor authentication and login anomaly detection, giving them the account access to withdraw funds - which Unit 42 notes may be more efficient than mining. The mining wallet address k1GqvkK7QYEfMj3JPHieBo1m7FUkTowdq6H was ranked a top miner in the koto-pool.work pool, so the campaign was already producing returns while it harvested credentials.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Identity & Access Management
Related