A new information stealer malware called MetaStealer has set its sights on Apple macOS, making the latest in a growing list of stealer families focused on the operating system after Stealer, Pureland, Atomic Stealer, and Realst.

“Threat actors are proactively targeting macOS businesses by posing as fake clients in order to socially engineer victims into launching malicious payloads,” SentinelOne security researcher Phil Stokes said in a Monday analysis.

In these attacks, MetaStealer is distributed in the form of rogue application bundles in the disk image format (DMG), with targets approached through threat actors posing as prospective design clients in order to share a password-protected ZIP archive containing the DMG file.
Other instances have involved the malware masquerading as Adobe files or installers for Adobe Photoshop. Evidence gathered so far shows that MetaStealer artifacts began appearing in the wild in March 2023. The most recent sample was uploaded to VirusTotal on August 27, 2023.

“This specific targeting of business users is somewhat unusual for macOS malware, which is more commonly found being distributed via torrent sites or suspicious third-party software distributors as cracked versions of business, productivity or other popular software,” Stokes said.

The main component of the payload is an obfuscated Go-based executable that comes with features to harvest data from iCloud Keychain, saved passwords, and files from the compromised host.

Select versions of the malware have been observed containing functions that likely target Telegram and Meta services.

SentinelOne said it observed some MetaStealer variants impersonating TradingView, the same tactic that has been adopted by Atomic Stealer in recent weeks.
This raises two possibilities: Either the same malware authors could be behind both the stealer families and have been adopted by different threat actors due to differences in the delivery mechanism, or they are the handiwork of disparate sets of actors.

“The appearance of yet another macOS infostealer this year shows the trend towards targeting Mac users for their data continues to rise in popularity among threat actors,” Stokes said.

“What makes MetaStealer notable among this crop of recent malware is the clear targeting of business users and the objective of exfiltrating valuable keychain and other information from these targets. Such high-value data can be used to pursue further cybercriminal activity or gain a foothold in a larger business network.”

According to Citizen Lab, a zero-click exploit chain known as BLASTPASS was used to actively exploit two zero-days that Apple fixed today in emergency security updates to install commercial spyware from NSO Group on fully patched iPhones.

The two bugs, followed as CVE-2023-41064 and CVE-2023-41061, permitted the assailants to taint a completely fixed iPhone running iOS 16.6 and having a place with a Washington DC-based common society association by means of PassKit connections containing malignant pictures.

“The exploit chain is referred to as BLASTPASS by us. Citizen Lab stated, “The exploit chain was capable of compromising iPhones running the most recent version of iOS (16.6) without the victim’s interaction.”

“The adventure included PassKit connections containing malevolent pictures sent from an assailant iMessage record to the person in question.”

Resident Lab likewise asked Apple clients to refresh their gadgets right away and empowered those in danger of designated assaults because of their character or calling to actuate Lockdown Mode.

The two zero-days were discovered in the Image I/O and Wallet frameworks by security researchers from Citizen Lab and Apple. CVE-2023-41064 is a buffer overflow that occurs when maliciously crafted images are processed, and CVE-2023-41061 is a validation issue that can be exploited by malicious attachments.

Both enable unauthorized code execution on unpatched iPhone and iPad devices by threat actors.

With improved logic and memory handling, Apple fixed flaws in macOS Ventura 13.5.2, iOS 16.6.1, iPadOS 16.6.1, and watchOS 9.6.2.

The following devices are on the affected list:

Apple has fixed a total of 13 zero-days exploited to target devices running iOS, macOS, iPadOS, and watchOS since the beginning of the year, including: iPhone 8 and later iPad Pro (all models), iPad Air 3rd generation and later, iPad 5th generation and later, and iPad mini 5th generation and later

two zero-days in July (CVE-2023-37450 and CVE-2023-38606),

three zero-days in June (CVE-2023-32434, CVE-2023-32435, and CVE-2023-32439),

four zero-days in May (CVE-2023-32409, CVE-2023-28204, and CVE-2023-32373),

and another WebKit zero-day in February (CVE-2023-23529).

To address the fourth Chrome zero-day vulnerability exploited in attacks since the beginning of the year, Google issued emergency security updates.

In a security advisory that was released on Monday, Google disclosed that the company was aware of the existence of an exploit for CVE-2023-4863.

Users in the Stable and Extended stable channels are currently receiving the new version, and it is anticipated that the entire user base will receive it in the coming days or weeks.
Chrome users are urged to upgrade their browsers as soon as possible to version 116.0.5845.187 (Mac and Linux) or 116.0.5845.187/.188 (Windows), which addresses the CVE-2023-4863 flaw in Windows, Mac, and Linux systems.

This update was quickly accessible when BleepingComputer checked for new updates through the Chrome menu > Help > About Google Chrome.

After a restart, the web browser will also check for new updates and install them without user intervention.
Assault subtleties not yet accessible
The basic zero-day weakness (CVE-2023-4863) is brought about by a WebP pile cushion flood shortcoming whose effect goes from collides with inconsistent code execution.

The bug was accounted for by Apple Security Designing and Engineering (Burn) and The Resident Lab at The College of Toronto’s Munk School last Wednesday, September 6.

Resident Lab security scientists have frequently found and revealed zero-day bugs manhandled in profoundly designated spyware assaults by government-supported danger entertainers focusing on high-risk people like resistance lawmakers, writers, and protesters around the world.

On Thursday, Apple fixed two zero-days labeled by Resident Lab as being taken advantage of in assaults as a feature of an endeavor fasten known as BLASTPASS to taint completely fixed iPhones with NSO Gathering’s Pegasus hired soldier spyware.
Although Google stated that the CVE-2023-4863 zero-day vulnerability has been exploited in the wild, the company has yet to provide any additional information regarding these attacks.

“Admittance to mess with subtleties and connections might be kept limited until a larger part of clients are refreshed with a fix,” Google said. ” If the bug is in a third-party library that other projects similarly rely on but have not yet fixed, we will also maintain restrictions.

This means Chrome users can update their browsers to stop attacks before more technical details are released. This could make it easier for more threat actors to make their own exploits and use them in the real world.