Tech
Everything you need to know about the malware stealing data from Mac users
Mac users have a new malware threat to be on the watch out for.
According to a new report by Malwarebytes, Infiniti Stealer is a new malware attack targeting Mac users that utilizes social engineering tactics and, once the payload is delivered to the device, is very difficult to detect.
Infiniti Stealer
The hacker's campaign, according to the report, begins with a social engineering technique known as ClickFix. ClickFix is a tactic that tricks the target themself into executing malicious code on their computer.
The targeted user is presented with a website, often through a phishing email or a pop-up on a compromised page, with an urgent update warning that claims to require the user to complete a Cloudflare human verification captcha.
The target is presented with a traditional "I am not a robot" box to check. However, the target is also asked to complete a "manual step." The page instructs the user to go to Spotlight on their Mac and search for the Terminal app. They are then instructed to paste a provided code into Terminal and hit return.
This code delivers Infiniti Stealer to the target's Mac.
"Because the user runs the command directly, many traditional defenses are bypassed," Malwarebytes says in its report. "There’s no exploit, no malicious attachment, and no drive‑by download."
According to Malwaybytes, the malware that's delivered to the victim's Mac is written in Python but compiled with Nuitka, which creates a native macOS binary. This makes Infiniti Stealer much more difficult to analyze and detect than the more typical type of malware.
"To our knowledge, this is the first documented macOS campaign combining ClickFix delivery with a Nuitka-compiled Python stealer," Malwarebytes says.
Once Infiniti Stealer is installed on a device, it will attempt to steal data from the victim's Mac and upload that information to the attacker's own server. Passwords, screenshots, browser data like cookies, and other sensitive information can be stolen from victims in these types of malware attacks.
Be aware of malware threats
Users should always be careful when following instructions from a website that they are unfamiliar with. Even then, users should be careful they are on a legitimate website of a company they do recognize and not a phishing website run by a bad actor.
Users should be aware that there is no form of captcha or verification that requires code to be entered in the Terminal app.
Furthermore, I typically recommend that anyone who isn't somewhat familiar with code to avoid any process that requires entering code in their Mac's Terminal.
If a user believes they may have been infected with malware, Malwarebytes recommends that they stop using the affected computer. They should change their account passwords on a completely separate device and, if possible, revoke access from the infected computer.
Infiniti Stealer appears to follow a new trend of bad actors targeting Apple devices due to the incorrect perception that they are immune from viruses and other types of attacks. DarkSword, for example, is another new threat targeting iPhones and other iOS devices with a malware attack that doesn't even require a user to download any sort of malicious file.
The problem with announcing any kind of news on April 1 is that absolutely nobody will believe you.
Case in point: On Wednesday morning, KitKat announced that customers could use a special online tracking tool to figure out if their purchased confectionery goods were part of the massive 12-ton KitKat heist that's gotten the internet's attention over the past few days.
The KitKat heist tracker was advertised on the official KitKat X account, and whoever runs the account is ardently insisting, both in the original post and in the replies, that this is real and not an April Fool's joke.
This Tweet is currently unavailable. It might be loading or has been removed.
Taking a look at the tracker itself, it's hard to parse fiction from reality. It appears to be a pretty straightforward tracker with a text input for an 8-digit batch code on the back of each KitKat package. I don't personally have any KitKats on hand to test this out with, but I typed in a random 8-digit number and was told that it wasn't part of the stolen batch.
So, at the very least, the tracker is actually checking for something. It's just impossible to say what would happen if you happened to type in a "correct" batch code.
Whether or not the tracker is a hoax, the heist was very real. More than 400,000 KitKat bars were stolen from a delivery truck going between Italy and Poland, prompting plenty of The Fast and the Furious memes (and some genuine concerns for the public supply of KitKats ahead of the Easter holiday).
For what it's worth, the company, Nestle KitKat, says there is no threat to the chocolatey supply chain at this time.
SAVE $400: As of April 1, the Hisense 55-inch Canvas QLED 4K TV is down to only $599.99 at Amazon. That's 40% off its list price and a new best price ever.
Opens in a new window
The Amazon Big Spring Sale delivered plenty of excellent TV deals, but budget-friendly brand Hisense isn't playing by the rules. While the brand (which is one of our favorites, BTW) did drop prices over the last week, it waited until the sale was officially over to give us its best prices ever on several TV models — including the coveted Canvas art TV.
As of April 1, the Hisense 55-inch Canvas QLED 4K TV is down to just $599.99 at Amazon. That's 40% or $400 off its list price and a new lowest price on record. For those curious, the same TV was $87.98 more during the Spring Sale.
The Canvas TV is an alternative to the popular Samsung The Frame TV for budget-conscious shoppers. Like The Frame, it transforms a basic black box into a stylish piece of artwork that hangs on your wall. Its matte finish allows it to blend seamlessly into a gallery wall with other non-tech wall hangings. Unlike The Frame, it uses Google TV's interface, which Mashable's Miller Kern (a Canvas TV owner) says is "way more intuitive and responsive than Samsung's."
Beyond doubling as artwork, the Hisense Canvas is a QLED TV, so it's noticeably brighter and more saturated than a basic LED TV. It'll look brilliant in any lighting conditions. It also features a variable refresh rate up to 144Hz, which is surprisingly good for gaming, real-time adaptive brightness and color temperature, and an ultra-slim wall mount that lies flush against the wall for the true framed art look.
Today's NYT Strands hints are easy if you believe in magic.
Strands, the New York Times' elevated word-search game, requires the player to perform a twist on the classic word search. Words can be made from linked letters — up, down, left, right, or diagonal, but words can also change direction, resulting in quirky shapes and patterns. Every single letter in the grid will be part of an answer. There's always a theme linking every solution, along with the "spangram," a special, word or phrase that sums up that day's theme, and spans the entire grid horizontally or vertically.
By providing an opaque hint and not providing the word list, Strands creates a brain-teasing game that takes a little longer to play than its other games, like Wordle and Connections.
If you're feeling stuck or just don't have 10 or more minutes to figure out today's puzzle, we've got all the NYT Strands hints for today's puzzle you need to progress at your preferred pace.
NYT Strands hint for today’s theme: While you were sleeping…
The words are related to a mythical creature.
Today’s NYT Strands theme plainly explained
These words describe a children's tradition.
NYT Strands spangram hint: Is it vertical or horizontal?
Today's NYT Strands spangram is horizontal.
NYT Strands spangram answer today
Today's spangram is Tooth Fairy.
NYT Strands word list for March 31
-
Wings
-
Exchange
-
Tutu
-
Wand
-
Coin
-
Note
-
Pillow
-
Tooth Fairy
Looking for other daily online games? Mashable's Games page has more hints, and if you're looking for more puzzles, Mashable's got games now!
Check out our games hub for Mahjong, Sudoku, free crossword, and more.
Not the day you're after? Here's the solution to yesterday's Strands.
Supreme Court Rules 8-1 Against Colorado’s Ban on ‘Conversion Therapy’ for Minors – Justice Jackson Dissents
Seat to Watch: Connecticut’s 5th District Erupts in Firestorm Over GOP Ben Proto’s Embattled Leadership
BREAKING: American Journalist Kidnapped by Iranian-Backed Militias in Central Baghdad (VIDEO)
SEND IN THE TROOPS! At Least 5 Dead, 10 Wounded So Far in Chicago Weekend Shootings
How I Paid Off My Mortgage 10 Years Early On A Teacher’s Salary
Black Lives Matter Activist in Boston Pleads Guilty to Federal Fraud Charges – Scammed Donors to Fund Her Lifestyle
-
Politics7 months agoSEND IN THE TROOPS! At Least 5 Dead, 10 Wounded So Far in Chicago Weekend Shootings
-
Business6 months ago
How I Paid Off My Mortgage 10 Years Early On A Teacher’s Salary
-
Politics6 months agoBlack Lives Matter Activist in Boston Pleads Guilty to Federal Fraud Charges – Scammed Donors to Fund Her Lifestyle
-
Tech7 months agoGet a lifetime subscription to the “ChatGPT for investors” for under $60
-
Tech6 months agoReview: The Dreame H15 Pro CarpetFlex is the first wet/dry vacuum I liked
-
Business7 months ago
25 Low-Effort Side Hustles You Can Start This Weekend
-
Business7 months ago
9 Ways to Command a Six-Figure Salary Without a Bachelor’s
-
Tech7 months agoHow much does the Roborock Saros Z70 cost? And does it ever go on sale?