Due to the widespread trust in unarchiver applications for extracting files, cybercriminals often exploit these tools to spread malware and other harmful files.
Recently, security researchers identified macOS malware disguised as an “Unarchiver” app, which allows attackers to steal user data. During routine research, cybersecurity experts at Hunt.io found a phishing site posing as theunarchiver[.]com. This site provides a suspicious disk image (TheUnarchiver.dmg).
The key differences between this fake site and the authentic one were a modified download button and a slightly altered domain name (tneunarchiver[.]com).
macOS Malware Masquerading as Unarchiver
Despite receiving low-risk scores from Hatching Triage (1/10) and no detections on VirusTotal, there is significant concern due to the misleading domain and cloned website. Historically, similar schemes have distributed genuine software through phishing tactics, necessitating careful scrutiny.
A thorough analysis of the disk image is essential to uncover any potential malicious activities that might not be immediately apparent, as artificially low risk scores could result from errors in execution or be intentionally misleading.
An unsigned disk image containing machine code for both ARM and Intel architectures was found within a suspicious “CryptoTrade” macOS file. This code, compiled using Swift, was ad-hoc signed on macOS 14.5 (May 2024).
The examination of its contents, including the Info.plist file and shared libraries, suggests malicious intent. The presence of code likely designed to capture user passwords indicates a deceptive installation process.
One URL found in the strings output (https://cryptomac[.]dev/download/grabber.zip) suggests additional malware might be accessible.
Despite these red flags, VirusTotal suppliers did not label it as malicious software, possibly due to incompatibility with older macOS versions used in analysis sandbox environments.
The “grabber.zip” file, undetected by VirusTotal, contains 10 shell scripts aimed at stealing user information.
The main script sets up a directory in the user’s Library folder, collects IP information, and runs various data-stealing scripts.
The stolen data is then compressed and sent to a remote server. Notably, Russian comments in one script hint at the malware’s origin.
This macOS-targeted stealer, similar to Amos and Poseidon, impersonates The Unarchiver app, utilizes Swift, and exfiltrates data to a common URL path (/api/index.php), yet it remains undetected by security vendors.
