Tech
Everything you need to know about the malware stealing data from Mac users
Mac users have a new malware threat to be on the watch out for.
According to a new report by Malwarebytes, Infiniti Stealer is a new malware attack targeting Mac users that utilizes social engineering tactics and, once the payload is delivered to the device, is very difficult to detect.
Infiniti Stealer
The hacker's campaign, according to the report, begins with a social engineering technique known as ClickFix. ClickFix is a tactic that tricks the target themself into executing malicious code on their computer.
The targeted user is presented with a website, often through a phishing email or a pop-up on a compromised page, with an urgent update warning that claims to require the user to complete a Cloudflare human verification captcha.
The target is presented with a traditional "I am not a robot" box to check. However, the target is also asked to complete a "manual step." The page instructs the user to go to Spotlight on their Mac and search for the Terminal app. They are then instructed to paste a provided code into Terminal and hit return.
This code delivers Infiniti Stealer to the target's Mac.
"Because the user runs the command directly, many traditional defenses are bypassed," Malwarebytes says in its report. "There’s no exploit, no malicious attachment, and no drive‑by download."
According to Malwaybytes, the malware that's delivered to the victim's Mac is written in Python but compiled with Nuitka, which creates a native macOS binary. This makes Infiniti Stealer much more difficult to analyze and detect than the more typical type of malware.
"To our knowledge, this is the first documented macOS campaign combining ClickFix delivery with a Nuitka-compiled Python stealer," Malwarebytes says.
Once Infiniti Stealer is installed on a device, it will attempt to steal data from the victim's Mac and upload that information to the attacker's own server. Passwords, screenshots, browser data like cookies, and other sensitive information can be stolen from victims in these types of malware attacks.
Be aware of malware threats
Users should always be careful when following instructions from a website that they are unfamiliar with. Even then, users should be careful they are on a legitimate website of a company they do recognize and not a phishing website run by a bad actor.
Users should be aware that there is no form of captcha or verification that requires code to be entered in the Terminal app.
Furthermore, I typically recommend that anyone who isn't somewhat familiar with code to avoid any process that requires entering code in their Mac's Terminal.
If a user believes they may have been infected with malware, Malwarebytes recommends that they stop using the affected computer. They should change their account passwords on a completely separate device and, if possible, revoke access from the infected computer.
Infiniti Stealer appears to follow a new trend of bad actors targeting Apple devices due to the incorrect perception that they are immune from viruses and other types of attacks. DarkSword, for example, is another new threat targeting iPhones and other iOS devices with a malware attack that doesn't even require a user to download any sort of malicious file.
NASA is set to send four astronauts on a mission around the moon for the first time in more than 50 years, and viewers can watch the launch countdown live on April 1.
Artemis II is a test flight of the U.S. space agency's Space Launch System rocket and Orion capsule. The mission follows Artemis I, the successful uncrewed inaugural voyage of the spacecraft in 2022.
NASA will stream the launch from Kennedy Space Center in Cape Canaveral, Florida, on its website, social media, and its YouTube channel. Live coverage of filling the rocket's tanks with fuel is expected to begin at 7:45 a.m. ET Wednesday on Youtube. Viewers can watch the event on NASA+, the space agency's free streaming service, starting at 12:50 p.m. ET.
The broadcast will track the four-person crew — Christina Koch, Victor Glover, Reid Wiseman, and Jeremy Hansen — as they board Orion. The actual two-hour launch window opens at 6:24 p.m. ET.
This mission is designed as a roughly 10-day deep space excursion that will loop around Earth before slingshotting around the moon and returning home. If successful, it would mark a major step toward future missions that aim to land astronauts on the lunar surface and establish a moon base there.
The flight also carries historic milestones. Koch is set to become the first woman to travel to the moon, and Glover the first Black astronaut to do so. Hansen, a Canadian astronaut, would be the first non-American assigned to a lunar mission. Their journey's estimated distance of 248,700 miles also could set a new record for farthest humans have ever traveled from Earth.
Watch the launch livestream here beginning at 7:45 a.m. ET on Wednesday, April 1.
NASA's live coverage typically includes real-time updates from the firing room, views from the launchpad, and commentary explaining each stage of the countdown. The agency will also provide rolling updates on its official Artemis blog.
The forecast so far shows an 80 percent chance of good weather conditions for launch day. Mission managers are mostly concerned about cloud coverage and high winds.
If the launch attempt is called off for weather or technical issues, the agency could try again any day through April 6. There is one other launch opportunity at the end of this month on April 30. NASA has declined to provide future launch windows beyond April to the public.
The problem with announcing any kind of news on April 1 is that absolutely nobody will believe you.
Case in point: On Wednesday morning, KitKat announced that customers could use a special online tracking tool to figure out if their purchased confectionery goods were part of the massive 12-ton KitKat heist that's gotten the internet's attention over the past few days.
The KitKat heist tracker was advertised on the official KitKat X account, and whoever runs the account is ardently insisting, both in the original post and in the replies, that this is real and not an April Fool's joke.
This Tweet is currently unavailable. It might be loading or has been removed.
Taking a look at the tracker itself, it's hard to parse fiction from reality. It appears to be a pretty straightforward tracker with a text input for an 8-digit batch code on the back of each KitKat package. I don't personally have any KitKats on hand to test this out with, but I typed in a random 8-digit number and was told that it wasn't part of the stolen batch.
So, at the very least, the tracker is actually checking for something. It's just impossible to say what would happen if you happened to type in a "correct" batch code.
Whether or not the tracker is a hoax, the heist was very real. More than 400,000 KitKat bars were stolen from a delivery truck going between Italy and Poland, prompting plenty of The Fast and the Furious memes (and some genuine concerns for the public supply of KitKats ahead of the Easter holiday).
For what it's worth, the company, Nestle KitKat, says there is no threat to the chocolatey supply chain at this time.
SAVE $400: As of April 1, the Hisense 55-inch Canvas QLED 4K TV is down to only $599.99 at Amazon. That's 40% off its list price and a new best price ever.
Opens in a new window
The Amazon Big Spring Sale delivered plenty of excellent TV deals, but budget-friendly brand Hisense isn't playing by the rules. While the brand (which is one of our favorites, BTW) did drop prices over the last week, it waited until the sale was officially over to give us its best prices ever on several TV models — including the coveted Canvas art TV.
As of April 1, the Hisense 55-inch Canvas QLED 4K TV is down to just $599.99 at Amazon. That's 40% or $400 off its list price and a new lowest price on record. For those curious, the same TV was $87.98 more during the Spring Sale.
The Canvas TV is an alternative to the popular Samsung The Frame TV for budget-conscious shoppers. Like The Frame, it transforms a basic black box into a stylish piece of artwork that hangs on your wall. Its matte finish allows it to blend seamlessly into a gallery wall with other non-tech wall hangings. Unlike The Frame, it uses Google TV's interface, which Mashable's Miller Kern (a Canvas TV owner) says is "way more intuitive and responsive than Samsung's."
Beyond doubling as artwork, the Hisense Canvas is a QLED TV, so it's noticeably brighter and more saturated than a basic LED TV. It'll look brilliant in any lighting conditions. It also features a variable refresh rate up to 144Hz, which is surprisingly good for gaming, real-time adaptive brightness and color temperature, and an ultra-slim wall mount that lies flush against the wall for the true framed art look.
Supreme Court Rules 8-1 Against Colorado’s Ban on ‘Conversion Therapy’ for Minors – Justice Jackson Dissents
Seat to Watch: Connecticut’s 5th District Erupts in Firestorm Over GOP Ben Proto’s Embattled Leadership
BREAKING: American Journalist Kidnapped by Iranian-Backed Militias in Central Baghdad (VIDEO)
SEND IN THE TROOPS! At Least 5 Dead, 10 Wounded So Far in Chicago Weekend Shootings
How I Paid Off My Mortgage 10 Years Early On A Teacher’s Salary
Black Lives Matter Activist in Boston Pleads Guilty to Federal Fraud Charges – Scammed Donors to Fund Her Lifestyle
-
Politics7 months agoSEND IN THE TROOPS! At Least 5 Dead, 10 Wounded So Far in Chicago Weekend Shootings
-
Business6 months ago
How I Paid Off My Mortgage 10 Years Early On A Teacher’s Salary
-
Politics6 months agoBlack Lives Matter Activist in Boston Pleads Guilty to Federal Fraud Charges – Scammed Donors to Fund Her Lifestyle
-
Tech7 months agoGet a lifetime subscription to the “ChatGPT for investors” for under $60
-
Tech6 months agoReview: The Dreame H15 Pro CarpetFlex is the first wet/dry vacuum I liked
-
Business7 months ago
25 Low-Effort Side Hustles You Can Start This Weekend
-
Business7 months ago
9 Ways to Command a Six-Figure Salary Without a Bachelor’s
-
Tech7 months agoHow much does the Roborock Saros Z70 cost? And does it ever go on sale?