Chilly Mac Malware & OAuth Phishing: Detection Tricks, No Treats

VMRay’s October Detection Highlights webinar details critical updates to Virtual Thread Identifiers (VTI) and YARA rules, with a significant focus on enhanced Mac OS threat detection and advanced malware analysis techniques.

Key Takeaways:
• A new VTI targets TOSS modular malware by detecting its efficient IP blacklisting behavior, mapped to the Impact tactic rather than Command and Control. 1:44
• Detection efforts now heavily target Mac OS threats, specifically Atomic Stealer and the notarized ChiliHell backdoor, reflecting a growing trend in macOS malware. 3:15
• Patrick Stapman demonstrates SteelC v2’s use of APC injection to stealthily inject code into browser processes, enabling the theft of sensitive web data and cookies. 4:00

These updates provide analysts with deeper visibility into emerging threats, particularly the increasing sophistication of Mac-targeted malware and complex evasion techniques like sleep and APC injection.

Sources:

• 1:44 Introduction to VTI and YARA rule updates for threat detection.
• 3:15 Overview of Mac OS threat landscape including Atomic Stealer.
• 4:00 Demo of SteelC v2 configuration extraction and APC injection.