MioLab - New Malware Targets macOS Users with ClickFix

What Happened

A new malware called MioLab, also known as Nova, has surfaced as a sophisticated infostealer targeting macOS users. This malware is being marketed on Russian-speaking underground forums, indicating a shift in the threat landscape. As Apple's market share increases, especially among software developers and cryptocurrency investors, attackers are now viewing Macs as lucrative targets.

MioLab operates as a Malware-as-a-Service (MaaS) platform, providing a user-friendly web panel and a compact payload that helps it evade detection by traditional antivirus software. This malware is capable of running on various macOS versions and supports both Intel and Apple Silicon architectures, making it a versatile threat.

Who's Being Targeted

MioLab is particularly aimed at high-value targets, including software engineers and cryptocurrency users. Its capabilities extend to stealing browser credentials, draining cryptocurrency wallets, and harvesting sensitive data from password managers. The malware's premium features allow it to target hardware wallets, extracting critical recovery phrases that can grant attackers access to victims' funds.

The malware's development pace is alarming, with frequent updates enhancing its functionality. Recent improvements include a rebuilt module for hardware wallet extraction and the ability to decrypt Apple Notes, showcasing the evolving nature of this threat.

Signs of Infection

One of the most concerning features of MioLab is its ClickFix delivery method, which tricks users into executing malicious commands through their macOS Terminal. This technique is particularly dangerous as it exploits the trust users place in legitimate command-line operations. The malware is delivered through convincing fake sites that mimic legitimate documentation, making it easy for unsuspecting users to fall victim.

Once executed, MioLab can collect a wide array of sensitive data, including browser cookies, passwords, and documents. It even has the capability to bypass macOS security features like Gatekeeper, making it a formidable adversary for both individual users and organizations.

How to Protect Yourself

To defend against the threat posed by MioLab, users and security teams must be vigilant. Here are some recommended actions:

• Educate users to be cautious of unexpected password prompts from newly downloaded applications.
• Monitor the use of sensitive macOS utilities, such as dscl and osascript, especially when invoked by unsigned applications.
• Audit access to critical directories, including browser profiles and the macOS Keychain.
• Block known malicious domains associated with MioLab and investigate any suspicious network activity.

By implementing these protective measures, users can better safeguard their sensitive information against this evolving malware threat.