{"id":101233,"date":"2024-07-25T08:49:59","date_gmt":"2024-07-25T15:49:59","guid":{"rendered":"https:\/\/www.intego.com\/mac-security-blog\/?p=101233"},"modified":"2024-12-07T00:21:13","modified_gmt":"2024-12-07T08:21:13","slug":"beavertail-and-invisibleferret-malware-target-job-seeking-mac-users","status":"publish","type":"post","link":"https:\/\/www.intego.com\/mac-security-blog\/beavertail-and-invisibleferret-malware-target-job-seeking-mac-users\/","title":{"rendered":"BeaverTail and InvisibleFerret malware target job-seeking Mac users"},"content":{"rendered":"

\"OSX\/BeaverTail<\/p>\n

On July 15, MalwareHunterTeam (MHT) posted a thread on X<\/a> about a fake videoconferencing app for Mac. The malware apparently targeted Mac users via unsolicited LinkedIn messages about job opportunities.<\/p>\n

Let’s take a brief look at what the malware does and how it was distributed.<\/p>\n

What do BeaverTail and InvisibleFerret malware do?<\/h3>\n

MalwareHunterTeam noted that the Trojan horse was fully undetected (“FUD”) by antivirus engines on VirusTotal as of that date. While this malware poses as an existing piece of software, it’s actually a malicious Trojan horse.<\/p>\n

\n

Interesting, FUD on VT, "MiroTalk.dmg": 9abf6b93eafb797a3556bea1fe8a3b7311d2864d5a9a3687fce84bc1ec4a428c
Payload \/ next stages are coming from 95.164.17[.]24:1224 (Stark AS 44477).
From a quick look, the next stages includes stealing from browsers, keylogging, installing AnyDesk,\u2026 pic.twitter.com\/YRIMLPl5r8<\/a><\/p>\n

— MalwareHunterTeam (@malwrhunterteam) July 15, 2024<\/a><\/p><\/blockquote>\n