ZeroFox Daily Intelligence Brief

ZeroFox Daily Intelligence Brief - March 28, 2023

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup with recommendations that aim to give you and your clients an advantage over the adversary.

Key Findings

New MacStealer macOS Malware Steals Passwords from iCloud Keychain
U.S. Government Bans Commercial Spyware That Poses Risks to National Security
Apples Releases Patches to Fix WebKit Zero-Day Bug in Older Devices
Twitter Files DMCA Notice over Source Code Leak on GitHub
Improve Mobile Device Security with This HC3 Checklist
Update: Latitude Confirms Details of 14 Million Consumers Stolen

New MacStealer macOS Malware Steals Passwords from iCloud Keychain

Mac users should be aware of a new info-stealing malware called MacStealer that targets their credentials, cryptocurrency wallets, and potentially sensitive files stored in iCloud KeyChain and web browsers. MacStealer is being distributed through a malware-as-a-service (MaaS) model; pre-built DMG payloads are sold for USD 100, and the malware can run on macOS Catalina (10.15) and up to the latest version of Apple's OS, Ventura (13.2). Upon executing the malware, a fake password prompt is served to the victim, allowing MacStealer to collect passwords, cookies, and credit card details from Firefox, Chrome, and Brave browsers on the compromised device. The malware stores this data into a ZIP archive, sending it to a remote command and control server to be received later by the threat actor while simultaneously sharing some basic information to a pre-configured Telegram channel, which quickly notifies the operator when new data is stolen and to download the ZIP file.

Recommendations:

Regularly update macOS operating systems and security software to ensure the latest security patches and to protect against new malware such as MacStealer.
Avoid downloading files from untrustworthy websites or opening email attachments from unknown senders, as these can be used to distribute malware and steal sensitive information.

U.S. Government Bans Commercial Spyware That Poses Risks to National Security

The Biden administration has issued an executive order prohibiting the use of commercial spyware by U.S. government agencies if it poses counterintelligence or security risks or could be exploited by foreign entities. The order outlines conditions under which commercial spyware is disqualified for use by the U.S. government, such as if it has been used to target the U.S. government or U.S. citizens or sold to countries engaged in serious human rights violations. While not an outright ban, the order narrows the market for commercial spyware. The executive order is one of several recent initiatives by the Biden administration to overhaul the national cybersecurity landscape and minimize foreign spying on public and private institutions.

Recommendation:

U.S.-based organizations should maintain awareness of the U.S. government's cybersecurity policies and advisories to stay informed of the latest threats, vulnerabilities, and best practices for safeguarding their systems.

Apple Releases Patches to Fix WebKit Zero-Day Bug in Older Devices

Apple has released patches that can be backported to old models of iPhones, iPads, and iPods to address a WebKit zero-day vulnerability (CVE-2023-23529); the company had previously deployed patches to fix this bug on newer devices. The patches are designed to stop potential attackers from leveraging this bug to crash the operating system on older compromised devices and perform remote code execution. This vulnerability allows threat actors to execute arbitrary code on targeted devices after tricking the victim into opening malicious web pages. The security bug affects all models of iPhone 6s and iPhone 7, iPhone SE (1st generation), iPad Air 2, iPad mini (4th generation), and iPod touch (7th generation).

Apple has not yet published technical details on how this vulnerability has been exploited in the wild, providing users time to update the software on their devices and slowing down attackers’ efforts to exploit vulnerable devices.

Recommendations:

Apple users of the affected device models should install the latest security updates as soon as possible to address this vulnerability.
Follow ZeroFox Intelligence to remain up to date on emerging threats.

Twitter Files DMCA Notice over Source Code Leak on GitHub

After filing a Digital Millennium Copyright Act (DMCA) notice, Twitter has been able to take down internal source code and tools for its platform that were leaked for months on GitHub. According to ZeroFox Intelligence research, Twitter has reportedly also asked Github to provide information on the access history for the leak, which could help in identifying both the actor who leaked the code and those who downloaded it. The leaker’s GitHub account is still active but does not contain public repositories. The social media giant is also attempting to use a subpoena to determine the identity of user “FreeSpeech Enthusiast,” who is believed to be a Twitter employee responsible for the leak. GitHub has reportedly complied with the DMCA infringement notice issued by Twitter, considering the leak exposed proprietary source code and internal tools.

Recommendation:

Follow ZeroFox Intelligence to remain up to date on the latest global cybersecurity news.

Improve Mobile Device Security with This HC3 Checklist

The Health Sector Cybersecurity Coordination Center (HC3) has recently published a mobile device security checklist geared towards helping healthcare organizations address common cybersecurity weak points and better protectbetter-protect their patient data. A wide range of mobile devices that collect, store, and transmit patient data often play a critical role in healthcare organizations; however, these essential devices also increase the cyber attack surface and contain vulnerabilities that can potentially be exploited to gain access to patient data and the healthcare networks. HC3’s mobile device security checklist includes recommendations for ensuring the security of all mobile devices used in healthcare.

Recommendations:

Limit the wireless connectivity of healthcare mobile devices unless it is essential.
Use caution before connecting such devices to any public or untrusted network; VPNs should be to connect devices to residential wireless networks, and data encryption should be in place if connecting to corporate enterprise infrastructure.
Keep software and applications up to date in order to protect against vulnerabilities, use strong authentication methods, and establish and require backup processes.
HC3’s checklist can be accessed and downloaded on the U.S. Department of Health & Human Services website.

Update: Latitude Confirms Details of 14 Million Consumers Stolen

Latitude Financial, a non-bank consumer loan company in Australia and New Zealand, has now confirmed that the mid-March cyberattack that was initially thought to have affected 300,000 customers has actually breached the data of 14 million customers—and may be the biggest data breach ever reported in Australia. The stolen data includes the personal information of current and former Latitude customers going back more than 10 years and includes the driver’s license numbers of 7.9 million Australian and New Zealand citizens. Latitude has reportedly not detected any hacker activity on its systems since March 16 and is working with the Australian Cyber Security Centre and the Australian Federal Police to investigate the incident.

Recommendations:

Latitude customers should be vigilant and on the lookout for suspicious behavior relating to their accounts.
Latitude will reimburse customers the cost of replacing their ID documents should they choose to do so.
Latitude customers should consider using data-protection services, such as those provided by ZeroFox’s IDX, to alert them of any misuse of their personal information following this breach.