![\"OSX\/DazzleSpy](\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2022\/01\/OSX-DazzleSpy-Mac-malware-logo-600x300-1.png\"){kind=logo}
<\/p>\n<\/p>\n
DazzleSpy is the latest Mac malware to make headlines. Intriguingly, it has the hallmarks of a state-sponsored, cyber-espionage campaign.<\/p>\n
Intego detects this malware’s various components as OSX\/DazzleSpy<\/strong>, OSX\/CDDS<\/strong>, OSX\/Exploit.Agent.C<\/strong>, and JS\/Exploit.Agent.NQK<\/strong>.<\/p>\n Let’s examine this threat and what makes it unique and interesting.<\/p>\n In this article:<\/p>\n In November 2021, teams from Google and ESET were independently researching a Mac malware campaign. The campaign leveraged what’s known as a watering hole attack\u2014where a group of people with a common interest is specifically targeted for infection. In this case, evidently the targeted class was people advocating for democracy in Hong Kong.<\/p>\n Erye Hernandez from Google’s Threat Analysis Group (TAG) first published<\/a> about the campaign on November 11. Hernandez noted that the watering hole campaign leveraged a vulnerability (CVE-2021-30869) that did not affect the then-current version of macOS Big Sur, but was exploitable on macOS Catalina.<\/p>\n Apple later released a patch for Catalina, as well as for iOS 12.5.5, on September 23 (as Intego noted here<\/a>). On the same day, Apple updated its security release notes for macOS Big Sur 11.2\u2014which had been released way back on February 1\u2014to acknowledge that the update had fixed the vulnerability nearly eight months earlier.<\/p>\n It’s quite interesting that Apple secretively patched a vulnerability in February for the then-latest macOS version, neglecting to patch it for other operating systems that were ostensibly still supported at the time\u2014and only admitting to it, and patching other affected operating systems, when the vulnerability was caught being used in the wild. As we’ve said before, Apple’s poor patching policies potentially make users’ security and privacy precarious<\/a>. It’s safest to stay up to date with the very latest version of Apple’s operating systems; older versions may get some, but not all, important security fixes.<\/p>\n\n
How was DazzleSpy discovered?<\/h3>\n