A new report published by Intel471 reveals that macOS is increasingly being targeted by threats developing malware specific to the operating system or using cross-platform languages to achieve their goals on macOS computers through malware being developed for Mac operating systems. It is also widely reported that macOS contains more vulnerabilities than other operating systems. There are many ways in which malware and exploits can be used to commit cybercrime and spy on individuals and businesses. 

According to a new report covering the subject, new research shows that macOS vulnerabilities exploited in 2023 increased by more than 30% compared to 2022. Many issues should be addressed as part of the Software Vulnerability Ratings Report 2024 issued by the patch management software company Action1. These include the fact that Microsoft Office programs are becoming easier to exploit and that attackers are increasingly attacking load balancers such as NGINX and Citrix.

According to Action1 analysts, it was possible to gain five insights into the threat landscape between 2022 and 2023 based on data available in both the National Vulnerability Database and CVEdetails.com. This NVD has seen a significant slowdown in the maintenance activity since February, as a large backlog of software and hardware flaws has been submitted to the National Institute of Standards and Technology, which is causing a decline in the number of maintenance activities. 

The NIST has said that the reason for the slowdown is that "the amount of software has increased and, therefore, so has the number of vulnerabilities as well as interagency support has changed.". As a result, they observed that between January 2023 and July 2024, more than 40 malicious actors attacked macOS systems with a variety of malware types, most commonly infostealers and trojans, which were one of the most popular threats. 

In recent years, information theft malware – also known as info stealers – has become increasingly popular and widespread across all operating systems. MacOS, of course, is not exempt from this trend. It has been reported by the cloud security company Uptycs that incidents involving info thieves have doubled in the first quarter of 2023 when compared to the same period of last year. Additionally, cyber security company Group-IB reported that underground sales of macOS infostealers have increased by five times in the last five years. 

Several types of software are utilized by cybercriminals. They use software to steal log-in credentials, session cookies that enable authentication without credentials, and even more sensitive information such as credit card information or cryptocurrency wallet addresses. A lot of companies have also started using this software to acquire legitimate credentials, which are then sold to other criminals, most of whom are buying them from companies instead of individuals. Atomic Stealer, which is also referred to as Atomic MacOS Stealer, or AMOS, has been one of the most popular MacOS data-stealing applications since 2023. 

There is a new security vulnerability in macOS devices and browsers that is designed to steal credentials and cryptocurrency wallet data from them. In addition, there are several other infostealers targeted at macOS that are being operated by cybercriminals or advertised. An anonymous threat actor nicknamed Code Hex advertised a Mac OS info thief known as ShadowVault, which can steal data from multiple Chrome-based browsers, files stored on compromised computers, as well as Bitcoin wallets by stealing information from their data storage. 

The fact that so many spyware providers have sold their services to state-sponsored threat actors in recent years does not mean that all threat actors do not develop malware and tools aimed at macOS as well. Among other threats, the North Korean threat actor BlueNoroff has developed a malware loader known as RustBucket that has been developed specifically for macOS, and which targets financial institutions that are involved in cryptocurrency-related activities. 

In the past, Russian threat actors became known for their use of macOS malware with the attack response team they formed, called APT28, which is part of the Russian General Staff of the Armed Forces, as well as APT29, another part of the Russian Foreign Intelligence Service. In APT29, the Empire cross-platform remote administration and post-exploitation framework was used, which, although no longer supported by Apple, did permit the use of macOS as a target. 

Among other things, the threat actor APT32, based in Vietnam, also released a macOS backdoor that was used to target different organization types. Furthermore, the perception that macOS has a lower amount of malware specific to it than Windows can further support this perception, as there is a relatively lower amount of macOS-specific malware available in comparison to Windows. Among the threat actors identified in the report, more than 40 are actively targeting macOS, with more than 20 actively trying to acquire malicious software crafted specifically for macOS. 

There are several ways in which this happens, including the purchase of pre-existing malware as well as commissioning the creation of new malware. The recent focus on info thieves, which steal sensitive data such as login credentials, session cookies, and credit card numbers, highlights that there is an immediate threat to consumers and businesses alike from these sorts of hackers. In addition to this, independent research also confirms the trend. The renowned security researcher Patrick Wardle reported in 2023 that there were twice as many macOS malicious programs compared to last year based on his observations. 

Similarly,        While different spyware providers have sold their services to state-sponsored threat actors, some of these threat actors do develop malware and tools aimed at macOS. North Korean threat actor BlueNoroff, for example, has developed a malicious loader known as RustBucket, developed for macOS and aimed at targeting financial institutions whose activities are related to cryptocurrencies. 

Russian threat actors APT28, part of the Russian Main Directorate of the General Staff of the Armed Forces, and APT29, part of Russia's Foreign Intelligence Service, have also used macOS malware. APT29 used the no-longer-supported Empire cross-platform remote administration and post-exploitation framework, enabling targeting of macOS. Vietnam-based threat actor APT32 also deployed a macOS backdoor used for targeting different organizations. The perception is further reinforced by the relatively smaller amount of macOS-specific malware compared to Windows, which can make it seem like an easier target. 

The report reveals that over 40 threat actors are actively engaged in targeting macOS, with more than 20 actively seeking to acquire malware specifically designed for the platform, including both the purchase of pre-existing malware and the commissioning of new malware development. The focus on info stealers, which steal sensitive data like login credentials, session cookies, and credit card information, highlights the immediate threat to individual users and businesses alike. The trend is further supported by independent research. 

Patrick Wardle, a renowned security researcher, observed a doubling of new macOS malware in 2023 compared to the previous year. Similarly, Group-IB, a cybersecurity firm, reported a fivefold increase in underground sales related to macOS infostealers. In the short term, infostealers and RATs are expected to remain the most prevalent threats to macOS users. However, the increasing presence of ransomware and other malware families suggests a growing sophistication and diversification of threats. 

The trend, coupled with the increasing number of threat actors targeting macOS, calls for heightened vigilance and proactive security measures. The report concludes with a stark warning: despite the perceived security of Apple products, macOS users should remain vigilant against various threats. The growing sophistication of malware and the increasing number of threat actors seeking to exploit vulnerabilities in the macOS ecosystem underscores the need for robust security measures, including the use of reputable antivirus software, regular software updates, and strong passwords. macOS systems must always be up to date and patched to avoid being affected by common security vulnerabilities. 

Security software should be deployed on systems to detect malware and suspicious activity. Email security solutions should also be used, as many initial breaches are spread via phishing emails. Finally, all employees need to be trained to spot potential social engineering techniques used in emails or instant messaging tools.