Tag
Mac Adware Injecting Malicious JavaScript via Obfuscated Python Script
2 rules 2 TTPs 1 IOCA Mac adware, likely a component of OSX.Pirrit, uses multiple layers of obfuscation, including base64 encoding, zlib compression, and variable renaming, to evade detection and inject malicious JavaScript from hxxps://1049434604.rsc.cdn77.org/ij1.min.js.
Adware Doctor Steals and Exfiltrates Browser History from Mac App Store Users
2 rules 2 TTPs 9 IOCsAdware Doctor, a popular app available on the Mac App Store, surreptitiously steals user's browsing history from Safari and Chrome, compresses the data into a password-protected zip archive, and exfiltrates it to a remote server.
Dragon Boss Solutions Adware Disabling Antivirus Protections
2 rules 2 TTPs 2 IOCsDigitally signed adware from Dragon Boss Solutions LLC deploys payloads with SYSTEM privileges to disable antivirus protections on thousands of endpoints across education, utilities, government, and healthcare sectors.
Mac File Opener Adware Persists via Document Handler Registration
2 rules 1 TTPThe 'Mac File Opener' adware achieves persistence by registering itself as a document handler for numerous file types, leveraging the Launch Services Daemon (lsd) to automatically parse the application's Info.plist and register the handlers.