Guardz Identifies New macOS hVNC Malware, Revealing Emerging Trend of macOS Attack-as-a-Service Tools

For the second time in one month, the Guardz research team discloses the existence of another malware targeting macOS devices available on the dark web, which enables malicious actors to obtain stealthy and continuous access to infected systems

TEL AVIV, Israel, Aug. 1, 2023 /PRNewswire/ -- Guardz, the cybersecurity company securing and insuring SMEs, today disclosed the existence of a Hidden Virtual Network Computing (hVNC) malware targeting macOS devices. The malware, which is available on the major Russian dark web forum Exploit, allows cybercriminals to gain and maintain persistent unauthorized access to a victim's Mac computer without being detected, and demonstrates the concerning emergence of a growing number of macOS-focused Attack-as-a-Service tools.

While cybercriminals have predominantly designed malware to target Microsoft Windows devices at scale, they are now increasingly developing tools for macOS. This shift directly affects small and medium-sized enterprises (SMEs), among whom macOS devices are widely utilized. Recently, Guardz identified an information stealing malware called 'ShadowVault,' which also exclusively targets macOS devices. This discovery, as well as the growing talk of macOS tools within underground cybercrime forums, suggests an imminent surge in cyberattacks against macOS users. SMEs, who once considered macOS as the safer option, should exercise caution and prepare themselves for the impacts of this changing threat landscape.

Traditional Virtual Network Computing (VNC) software allows users to remotely control another computer over a network with permission and is often used for remote technical support. hVNC is a nefarious variation of this technology, typically distributed through attack vectors such as email attachments, malicious websites, or exploit kits. The macOS hVNC identified by Guardz has been available since April 2023, with updates made as recently as July 13, 2023, and was tested on a wide array of macOS versions from 10 through 13.2. It is being sold at a lifetime price of $60K with additional capabilities available for an added fee, on offer from an active Exploit forum member called RastaFarEye. The forum member holds a significant track record of malicious activity, having already developed a Windows OS hVNC variant, among other attack tools.

The macOS malware operates covertly, gaining access without requesting permission from the user and deliberately concealing its presence to evade detection by SMEs. Its persistence mechanisms ensure its continued activity even after system reboots or attempts at removal. It is mainly utilized to perpetrate data theft, with a focus on extracting sensitive information from employees' computers, including login credentials, personal data, financial information, and more. This combination of stealth, persistence, data theft, and remote control makes the malware a very potent tool in the hands of malicious actors.

"SMEs must remain vigilant and work with their trusted MSP partners to obtain complete protection against the growing threats targeting the macOS systems that were previously assumed to be more secure," said Dor Eisner, CEO and Co-Founder of Guardz. "As with all Attack-as-a-Service tools, protecting against this new stealth malware requires robust and active cybersecurity measures, as well as ongoing user education about the risks of suspicious email attachments and files from untrustworthy sources, in particular. We look forward to continuing to shed light on emerging threats to help more companies and MSP partners ensure that their business and employees remain secure." 

The revelation by Guardz follows the company's disclosure of the ShadowVault malware in July 2023, when the Guardz research team announced the existence of the new information stealer, available for rent on the dark web's popular XSS forum. The malware is capable of stealing sensitive data from macOS-based devices, posing a significant threat to businesses and individuals alike.

To learn more about the newly disclosed macOS hVNC and the rising trend of threats against SMEs, see Guardz's recent blog post here.

About Guardz
Guardz is a holistic cyber security and insurance solution designed for SMEs. Its all-in-one, affordable platform is on guard 24/7, and is easy to use for both in-house IT personnel and MSPs. With cutting-edge technologies stacked into a robust platform, Guardz's solution continuously monitors businesses' digital landscapes to protect their entire range of assets, enables them to react to cyber risks in real time with swift remediations, and provides cyber insurance for peace of mind. Guardz was founded in 2022 by Dor Eisner and Alon Lavi along with a team of cyber and insurance experts who combine innovation, experience, and creativity to create a safer digital world for small businesses.

Press Contact
Allison Grey
Headline Media
[email protected] 
US: +1 323 283 8176
UK: +44 203 807 4482
IL: +972 53 820 2606 

SOURCE Guardz

WANT YOUR COMPANY'S NEWS FEATURED ON PRNEWSWIRE.COM?

440k+
Newsrooms &
Influencers

9k+
Digital Media
Outlets

270k+
Journalists
Opted In

GET STARTED