Microsoft has detailed the evolution of a relatively new piece of Mac malware called UpdateAgent that started out stealing system information in late 2020 but has morphed into a tool for delivering adware and potentially other threats.
One of UpdateAgent’s newest and most potent features is the ability to bypass Apple’s built-in Gatekeeper system that is meant to allow only trusted, signed apps to run on Macs.
Microsoft flagged the malware now as it appears to be under continuous development. Today, it installs an “unusually persistent” adware threat called Adload, but Microsoft cautions it could be used to distribute other more dangerous payloads in future. For example, Microsoft found its makers host additional payloads on Amazon Web Services’ S3 and CloudFront services.
SEE: Cybersecurity: Let’s get tactical (ZDNet special report)
While it does require the victim to install an app masquerading as legitimate software, such as a video app or support agent promoted in ad pop-ups, the ability to bypass Gatekeeper controls is significant. It can also use existing user permissions to delete evidence of its presence on a system.
Since its discovery between September to December 2020, when it was only an information stealer, the malware has undergone several upgrades to improve persistence allowing it to remain on a system after users sign in to the affected device. By January 2021, it could fetch secondary payloads as .dmg files for macOS from public cloud providers.
In March 2021, it was updated again to fetch compressed .zip files instead of .dmg files and tweaked to prevent Gatekeeper from displaying the pop-up warning to users that a file is from an “unidentified developer”. Then in August, it was improved with changes that allowed the malware to inject persistent code that ran as root in a background process that’s invisible to the user.
“UpdateAgent is uniquely characterized by its gradual upgrading of persistence techniques, a key feature that indicates this trojan will likely continue to use more sophisticated techniques in future campaigns,” Microsoft says in a blogpost, cautioning it could follow the trajectory of malware common to Windows.
“Like many information-stealers found on other platforms, the malware attempts to infiltrate macOS machines to steal data and it is associated with other types of malicious payloads, increasing the chances of multiple infections on a device.”
UpdateAgent’s makers started distributing Adload as a secondary payload in October 2021 when Microsoft raised an alarm it was distributing malware through public cloud providers. Microsoft says it has coordinated with AWS to remove malicious links from its cloud services. Adload is capable of opening a backdoor to install other payloads.
“Once adware is installed, it uses ad injection software and techniques to intercept a device’s online communications and redirect users’ traffic through the adware operators’ servers, injecting advertisements and promotions into webpages and search results,” Microsoft notes.
“More specifically, Adload leverages a Person-in-The-Middle (PiTM) attack by installing a web proxy to hijack search engine results and inject advertisements into webpages, thereby siphoning ad revenue from official website holders to the adware operators.”
Microsoft is interested in Mac malware because more enterprises support non-Windows devices on corporate networks. It is encouraging defenders to use its Edge browser on macOS since it supports Microsoft’s Defender SmartScreen for blocking malicious websites.
Meanwhile, Microsoft’s Defender for Endpoint enterprise security platform can be used to detect UpdateAgent’s misuse of Apple’s PlistBuddy tool for managing PLIST (property list) attribute files for macOS applications.
