Cointime

Cointime

Download App
iOS & Android
Home / Security

XLoader Malware Masquerades As ‘OfficeNote’ App To Steal Sensitive Information From Mac Users

According to the latest report from network security company SentinelOne, the new version of the XLoader malicious tool has been recompiled using C and Objective C languages and signed by Apple developers. Attackers further disguised the XLoader malicious tool as a Microsoft Office productivity application called "OfficeNote" and distributed it through an application called "OfficeNote.dmg".

The report states that although Apple has revoked the developer account, Apple's malicious software interception tool XProtect did not prevent the application from running. This malicious software targets Chrome and Firefox browsers and then steals information stored in the user's clipboard through Apple's own API.

Apple
Comments

All Comments

Recommended for you

  • Chainlink ·

    What Is Tokenization?

    Tokenization is the process of creating a digital representation of an asset by issuing a blockchain-based token.
    What Is Tokenization?

  • SlowMist: Beware of watering hole attacks launched by malicious attackers using WordPress plugin vulnerabilities

    SlowMist Security has issued a warning that attackers have recently been exploiting vulnerabilities in WordPress plugins to inject malicious JS code into normal websites and launch watering hole attacks. These attacks involve popping up malicious windows when users visit the site, deceiving them into executing malicious code or performing Web3 wallet signatures, thereby stealing their assets. It is recommended that sites using WordPress plugins check for vulnerabilities, update plugins in a timely manner, and avoid being attacked. When visiting any website, users should carefully identify the downloaded programs and Web3 signature content to avoid downloading malicious programs or having their assets stolen due to malicious signatures.

  • Unverified Ember Sword NFT auction contract vulnerability has caused nearly $200,000 in losses

    Certik has discovered a vulnerability in the unverified Ember Sword NFT auction contract, which has earned 60 WETH (approximately $195,000) from 159 victims who approved the contract. Certik reminds users to revoke their approval of the relevant contract on Polygon.

  • zkSync ecological lending platform xBank Finance suspected of RUG

    xBank Finance, a zkSync ecosystem lending platform, was suspected of being a RUG, and the protocol's TVL was close to zero. The project's official Twitter account has been frozen.

  • Scammers use fake USDT balances to defraud cryptocurrency users

    SlowMist has partnered with Imtoken to uncover a new cryptocurrency scam that uses offline transactions and USDT. Scammers manipulate the Ethereum RPC to falsify the USDT balance in the victim's wallet. The scammer lures the victim to change their Ethereum RPC URL to a URL controlled by them, making it appear that the victim has deposited USDT funds, but in reality, the victim is left empty-handed when attempting to trade. In addition, the scam also deceives users through small transfers to gain trust, then manipulates account balances and contract information, posing serious risks to unsuspecting users and is related to a wider range of pig slaughter scam activities.

  • El Salvador's official Bitcoin wallet refutes rumors it was hacked

    Salvadoran official cryptocurrency wallet Chivo Wallet denies reports that its source code and over 5 million user data related to KYC procedures have been hacked. The wallet's management department clarified that its data security has not been compromised and the leaked data did not come from their system.

  • Alliance of 314: The X314 contract is suspected to have a hidden additional issuance switch, developers should pay attention to verification

    Alliance of 314 issued a statement claiming that the contract of a certain 314 project has not been open-sourced on the blockchain. As for whether other platforms have open-sourced their contracts, there is a misconception that open-sourcing on other platforms is self-submitted and does not necessarily mean that the contract is deployed on the chain, so there may be unknown hidden issuance. Additionally, the said 314 project announced that it will soon launch a trading platform, and the first requirement for logging into a centralized exchange is to open-source the contract. Open-sourcing is the first thing that any project should do to ensure investor confidence. Referring to the open-sourcing of the 0.1, 0.5, and 0.9 versions before, it can be concluded that there is hidden code in the X314 contract, and therefore it cannot be open-sourced out of fear. The biggest risk warning: after decompiling and querying ethervm, it is highly suspected that a certain 314 has a hidden issuance switch to increase mining pool output and arbitrage. The field is as follows: 0x40c10f19mint(address,uint256). The risk alert level for this switch is the highest level, and generally, ordinary developers do not set this switch.

  • Magpie: A vulnerability was found in the contract, and users are advised to cancel authorization as soon as possible

    Cross-chain infrastructure Magpie Protocol published an article stating that there is a vulnerability in the contract and urging users who have authorized its contract and still hold funds in their wallets to cancel the relevant contract authorization on each chain as soon as possible.

  • SlowMist reveals a new scam: maliciously modifying RPC node links to defraud assets

    SlowMist security team has exposed a new type of cryptocurrency scam. This scam uses the remote procedure call (RPC) function of modified Ethereum nodes to commit fraud. The specific process of the scam is as follows: the scammer induces the user to download the imToken wallet and gain the user's trust by using 1 USDT and a small amount of ETH as bait. Then, the scammer guides the user to change their ETH's RPC URL to the node controlled by the scammer. The node uses Tenderly's fork function to falsify the user's USDT balance. When the user sees the incorrect balance, they may attempt a transfer, but the scammer has already disappeared. According to SlowMist Technology's report, this type of scam exploits users' trust and negligence, resulting in asset losses. The SlowMist security team reminds users to remain vigilant when trading and avoid using untrusted RPC nodes.

  • freezingwatermelon.eth lost 19.12 stETH due to phishing

    According to PeckShield's monitoring, freezingwatermelon.eth suffered a phishing attack, resulting in a loss of 19.12 stETH (worth about $60,800).

Daily Must-Read

Popular Activities

Delysium $AGI & AI Private Yacht Party

Delysium $AGI & AI Private Yacht Party

March 27 - March 27
Seoul

Popular Tags

Cointime
News
Contents
RSS
Company