Wardle wasn't able to completely dissect this piece of malware, so he's not quite sure what it does.īut he discovered that the server where it resides has been flagged as hosting a pirated copy of Cobalt Strike, a legitimate penetration-testing tool that criminals have cracked and repurposed for illicit means.Īs Wardle noted, it's possible that this mysterious fake Google Update is actually a Cobalt Strike "beacon," a program that creates a hidden backdoor on a system for other Cobalt Strike users to find. The other piece of malware masquerades as a Google Update application and is downloaded from a different server. (iTerm2 is a free alternative to the default Mac terminal app.) This time around, Zhi was publicizing a blog post by a Chinese user who had found that queries on the Chinese search engine Baidu for the Mac app iTerm2 returned a clone of the legitimate iTerm2 website. Plus: iPhone 13 release date, price, specs and latest newsĪs detailed by Mac security researcher Patrick Wardle in a blog post earlier this week, the malware, which he calls ZuRu, was tweeted out by Chinese reseacher Zhi, aka ChiChou, aka Back in June, Zhi helped puzzle out why certain Wi-Fi network names were disabling iPhones.Apple emergency update for iPhones, Macs and Apple Watches - what to do.You should also get your software from the Mac App Store as often as possible, and be wary of other sources.
To make sure you're not infected by this sort of thing, be very careful about what you download and scan every downloaded file with one of the best Mac antivirus programs.
0 kommentar(er)
