¡Ay, MaMi! New DNS-Hijacking Mac Malware Discovered.

Ay MaMi - Analyzing a New macOS DNS Hijacker: OSX.MaMi.

/ / / / hijacks infected users’ DNS settings and installs a malicious certificate into the System keychain, in order to give remote attackers access to all network traffic (likely for adware-related purposes).

The Malwareland channel on the MacAdmins Slack.

I’d personally like to thank the following organizations, groups, and researchers for their work, analysis, and assistance! I’ve all samples covered in this post, are available in Objective-See’s malware collection. …or click ‘Subscribe’ (at the top of the page), to subscribe to our newsletter for updates!įor each malware specimen, we’ll identify the malware’s infection vector, persistence mechanism, and features & goals. Built on top of this, is ‘GamePlan’: a comprehensive macOS malware protection/detection/hunting product.įor more info, checkout: “Leveraging Apple’s Game Engine for Advanced Threat Detection”

Specifically we’re hard at work on a neat open-source framework (‘MonitorKit’) that incorporates many of these proven advanced detection heuristics into a single library. We’re big fans of the Objective-See tools mentioned in this blog, so much so that we’ve partnered with them! by the AV company that discovered them), this blog aims to cumulatively cover all new Mac malware of 2018 - in one place.

While the specimens may have been briefly reported on before (i.e. Hooray, it’s the New Year! 2019 is going to be incredible, right? …right?įor the third year in a row, I’ve decided to post a blog that comprehensively covers all the new Mac malware that appeared during the course of the year.

Automator mac virus