Hackers Using Google Ads To Deliver ‘Poseidon’ Mac Stealer

Hackers abuse Mac Stealer to covertly extract sensitive information such as passwords, financial data, and personal files from macOS devices.

Besides this, macOS users or Mac users are considered valuer targets.

On June 24th, Malwarebytes researchers identified another Mac-specific stealer campaign named Poseidon. This campaign used Google malicious ads for the Arc browser.

This is the second instance of Arc being used as a lure by OSX in recent times. RodStealer is distributing malware.

Created by Rodrigo4, a threat actor who competed with Atomic Stealer, this tool is more developed and can steal VPN configurations.

Hackers Using Google Ads

The ad for this malware was found on the XSS underground forum and it offers similar functionalities to Atomic Stealer such as file grabbing, extraction of crypto wallets, and theft of password managers.

"Is Your System Under Attack? Try Cynet XDR: Automated Detection & Response for Endpoints, Networks, & Users!"- Free Demo

What this campaign shows is that attackers responsible for Mac-related malware have started using new strategies while always exploiting popular software.

A Google ad campaign for the Arc browser that maliciously redirects people to a fraudulent site (arc-download[.]com) that offers a Mac-only version is connected to “Coles & Co” and arcthost[.]org.

The downloaded DMG file uses a right-click bypass for security to make it seem like a genuine Mac application installation process.

This recent malware called “Poseidon,” which builds on previous ones, has incomplete code for stealing VPN configurations from Fortinet and OpenVPN.

Malware exfiltrates data to a specific IP address leading to a Poseidon-branded control panel, implying a sophisticated and evolving risk to MacOS users.

An active Mac malware development scene focuses on stealers like Poseidon. Threat actors advertise feature-rich products with low antivirus detection to potential customers. 

The observed campaign confirms the active targeting of new victims. Protection requires vigilance when installing new apps. 

Malwarebytes continues detecting this threat as OSX.RodStealer and has informed Google about the malicious ad. 

Users are advised to employ web protection tools like Malwarebytes Browser Guard to block ads and malicious websites as a primary defense against such evolving Mac-targeted threats.

IoCs

Are you from SOC/DFIR Teams? - Sign up for a free ANY.RUN account! to Analyse Advanced Malware Files