The official website for the BitTorrent client Transmission has once again been abused by cybercriminals to deliver a piece of malware designed to target OS X systems.
The security firm ESET warned last month that a new Mac OS X malware started doing the rounds. The threat, dubbed OSX/Keydnap, is capable of stealing the content of the OS X keychain and maintaining a permanent backdoor on the infected system.
At the time, researchers were uncertain how Keydnap had been distributed, but they suspected that cybercriminals used spam messages and downloads from untrusted websites. In reality, it turns out that the malware has also been distributed from a legitimate website.
According to ESET, cybercriminals compromised the official Transmission site and replaced the legitimate application with a malicious version. Experts believe the malware was available for download as Transmission v2.92 between August 28 and August 29.
Users who downloaded the app in this timeframe can determine if they are infected by checking if certain files associated with the malware can be found on their system. Indicators of compromise (IoC) are available on ESET’s website.
This was not the first time Mac malware had been served from the Transmission website. In March, Palo Alto Networks warned that a piece of ransomware dubbed KeRanger, which is believed to be based on Linux.Encoder, was delivered via the official Transmission installer.
ESET has found several similarities between KeRanger and Keydnap, such as the fact that both malicious apps were signed with legitimate code-signing certificates that allowed them to bypass Apple’s Gatekeeper feature. Researchers also noticed similarities in the code, including the path and parameter used for the command and control (C&C) URL resource.
The version of Keydnap delivered via the Transmission website is version 1.5. Compared to the version analyzed by ESET last month, it includes a standalone Tor client that allows it to reach its C&C server over the Tor network without needing a separate Tor2Web relay. It also includes a new command that allows cybercriminals to set a different URL for the C&C server.
Related Reading: OS X Backdoor Provides Unfettered Access to Mac Systems
Related Reading: Israeli Ad Company Behind “Pirrit” OS X Adware
Related Reading: New Tool Aims to Generically Detect Mac OS X Ransomware
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- In Other News: Government Use of Spyware, New Industrial Security Tools, Japan Router Hack
- Apple Denies Helping US Government Hack Russian iPhones
- Zero-Day in MOVEit File Transfer Software Exploited to Steal Data From Organizations
- Russia Blames US Intelligence for iOS Zero-Click Attacks
- Cisco Acquiring Armorblox for Predictive and Generative AI Technology
- Moxa Patches MXsecurity Vulnerabilities That Could Be Exploited in OT Attacks
- Organizations Warned of Salesforce ‘Ghost Sites’ Exposing Sensitive Information
- Organizations Warned of Backdoor Feature in Hundreds of Gigabyte Motherboards
Latest News
- Insider Q&A: Artificial Intelligence and Cybersecurity In Military Tech
- In Other News: Government Use of Spyware, New Industrial Security Tools, Japan Router Hack
- OpenAI Unveils Million-Dollar Cybersecurity Grant Program
- Galvanick Banks $10 Million for Industrial XDR Technology
- Information of 2.5M People Stolen in Ransomware Attack at Massachusetts Health Insurer
- US, South Korea Detail North Korea’s Social Engineering Techniques
- High-Severity Vulnerabilities Patched in Splunk Enterprise
- Idaho Hospitals Working to Resume Full Operations After Cyberattack
