{"id":4363,"date":"2021-11-05T15:00:50","date_gmt":"2021-11-05T15:00:50","guid":{"rendered":"https:\/\/www.maisetechnology.com\/?p=4363"},"modified":"2023-02-22T19:21:03","modified_gmt":"2023-02-22T19:21:03","slug":"this-mac-malware-should-have-users-worried","status":"publish","type":"post","link":"https:\/\/www.maisetechnology.com\/2021\/11\/05\/this-mac-malware-should-have-users-worried\/","title":{"rendered":"This Mac Malware Should Have Users Worried"},"content":{"rendered":"<div class=\"wpb-content-wrapper\"><p>[vc_row][vc_column][vc_column_text]<img decoding=\"async\" class=\"alignleft size-full wp-image-15170\" src=\"\/wp-content\/uploads\/2023\/02\/mac-resized.png\" alt=\"This Mac Malware Should Have Users Worried\" width=\"\" height=\"\" \/>Researchers from Microsoft have reported the discovery of a new variant of macOS malware called WizardUpdate.<\/p>\n<p>The new version should worry all Mac users because it has been upgraded to incorporate enhanced evasion and persistence tactics that will make it more difficult to track, locate and ultimately stop.<\/p>\n<p>WizardUpdate is also known as UpdateAgent and it is based on code that is distributed via download repositories. That is where it masquerades as a legitimate software. Although the researchers found no direct indication of how this new variant is distributed it follows that the group behind the code would use similar if not outright identical techniques.<\/p>\n<p>WizardUpdate has had a short but interesting history. It was first discovered in November 2020. In its earliest incarnation the code could do little more than collecting and exfiltrating basic system information. That proved to be but a simple test. Since its initial release WizardUpdate has seen numerous upgrades.<\/p>\n<p><b>The latest build includes the following capabilities:<\/b><\/p>\n<ul>\n<li>To grant admin permissions to regular users<\/li>\n<li>To leverage existing user profiles to execute commands<\/li>\n<li>To modify PLIST files using PlistBuddy<\/li>\n<li>To bypass Gatekeeper by removing quarantine attributes from downloaded payloads<\/li>\n<li>To grab the full download history for infected Macs by enumerating LSQuarantineDataURL String using SQLite<\/li>\n<li>And to deploy secondary payloads downloaded from cloud infrastructure<\/li>\n<\/ul>\n<p><b>Microsoft had this to say about the newly discovered strain:<\/b><\/p>\n<p><i>&#8220;UpdateAgent abuses public cloud infrastructure to host additional payloads and attempts to bypass Gatekeeper, which is designed to ensure that only trusted apps run on Mac devices, by removing the downloaded file&#8217;s quarantine attribute.&#8221;<\/i><\/p>\n<p><i>&#8220;It also leverages existing user permissions to create folders on the affected device. It uses PlistBuddy\u00a0<\/i><i>to create and modify Plists in LaunchAgent\/ LaunchDeamon for persistence.&#8221;<\/i><\/p>\n<p>WizardUpdate by any name is a scarily capable malware strain and Mac users should be on high alert.[\/vc_column_text][\/vc_column][\/vc_row]<\/p>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>[vc_row][vc_column][vc_column_text]Researchers from Microsoft have reported the discovery of a new variant of macOS malware called WizardUpdate. The new version should worry all Mac users because it has been upgraded to incorporate enhanced evasion and persistence tactics that will make it more difficult to track, locate and ultimately stop. WizardUpdate is also known as UpdateAgent and&hellip;<\/p>\n","protected":false},"author":2,"featured_media":4364,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[11],"tags":[100,190,37,14,17,20,374],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v22.6 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>This Mac Malware Should Have Users Worried | Maise Technology<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.maisetechnology.com\/2021\/11\/05\/this-mac-malware-should-have-users-worried\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"This Mac Malware Should Have Users Worried | Maise Technology\" \/>\n<meta property=\"og:description\" content=\"[vc_row][vc_column][vc_column_text]Researchers from Microsoft have reported the discovery of a new variant of macOS malware called WizardUpdate. The new version should worry all Mac users because it has been upgraded to incorporate enhanced evasion and persistence tactics that will make it more difficult to track, locate and ultimately stop. WizardUpdate is also known as UpdateAgent and&hellip;\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.maisetechnology.com\/2021\/11\/05\/this-mac-malware-should-have-users-worried\/\" \/>\n<meta property=\"og:site_name\" content=\"Maise Technology\" \/>\n<meta property=\"article:published_time\" content=\"2021-11-05T15:00:50+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-02-22T19:21:03+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.maisetechnology.com\/wp-content\/uploads\/2023\/02\/mac-resized.png\" \/>\n\t<meta property=\"og:image:width\" content=\"300\" \/>\n\t<meta property=\"og:image:height\" content=\"225\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"maisegroup\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"maisegroup\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.maisetechnology.com\/2021\/11\/05\/this-mac-malware-should-have-users-worried\/\",\"url\":\"https:\/\/www.maisetechnology.com\/2021\/11\/05\/this-mac-malware-should-have-users-worried\/\",\"name\":\"This Mac Malware Should Have Users Worried | Maise Technology\",\"isPartOf\":{\"@id\":\"https:\/\/www.maisetechnology.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.maisetechnology.com\/2021\/11\/05\/this-mac-malware-should-have-users-worried\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.maisetechnology.com\/2021\/11\/05\/this-mac-malware-should-have-users-worried\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.maisetechnology.com\/wp-content\/uploads\/2023\/02\/mac-resized.png\",\"datePublished\":\"2021-11-05T15:00:50+00:00\",\"dateModified\":\"2023-02-22T19:21:03+00:00\",\"author\":{\"@id\":\"https:\/\/www.maisetechnology.com\/#\/schema\/person\/eb4c832909343bad9b29835cbde276a5\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.maisetechnology.com\/2021\/11\/05\/this-mac-malware-should-have-users-worried\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.maisetechnology.com\/2021\/11\/05\/this-mac-malware-should-have-users-worried\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.maisetechnology.com\/2021\/11\/05\/this-mac-malware-should-have-users-worried\/#primaryimage\",\"url\":\"https:\/\/www.maisetechnology.com\/wp-content\/uploads\/2023\/02\/mac-resized.png\",\"contentUrl\":\"https:\/\/www.maisetechnology.com\/wp-content\/uploads\/2023\/02\/mac-resized.png\",\"width\":300,\"height\":225,\"caption\":\"This Mac Malware Should Have Users Worried\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.maisetechnology.com\/2021\/11\/05\/this-mac-malware-should-have-users-worried\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.maisetechnology.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"This Mac Malware Should Have Users Worried\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.maisetechnology.com\/#website\",\"url\":\"https:\/\/www.maisetechnology.com\/\",\"name\":\"Maise Technology\",\"description\":\"Just another WordPress site\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.maisetechnology.com\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.maisetechnology.com\/#\/schema\/person\/eb4c832909343bad9b29835cbde276a5\",\"name\":\"maisegroup\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.maisetechnology.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/253b0df440d3cf0019e97554b1e058c6?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/253b0df440d3cf0019e97554b1e058c6?s=96&d=mm&r=g\",\"caption\":\"maisegroup\"},\"url\":\"https:\/\/www.maisetechnology.com\/author\/maisegroup\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"This Mac Malware Should Have Users Worried | Maise Technology","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.maisetechnology.com\/2021\/11\/05\/this-mac-malware-should-have-users-worried\/","og_locale":"en_US","og_type":"article","og_title":"This Mac Malware Should Have Users Worried | Maise Technology","og_description":"[vc_row][vc_column][vc_column_text]Researchers from Microsoft have reported the discovery of a new variant of macOS malware called WizardUpdate. The new version should worry all Mac users because it has been upgraded to incorporate enhanced evasion and persistence tactics that will make it more difficult to track, locate and ultimately stop. WizardUpdate is also known as UpdateAgent and&hellip;","og_url":"https:\/\/www.maisetechnology.com\/2021\/11\/05\/this-mac-malware-should-have-users-worried\/","og_site_name":"Maise Technology","article_published_time":"2021-11-05T15:00:50+00:00","article_modified_time":"2023-02-22T19:21:03+00:00","og_image":[{"width":300,"height":225,"url":"https:\/\/www.maisetechnology.com\/wp-content\/uploads\/2023\/02\/mac-resized.png","type":"image\/png"}],"author":"maisegroup","twitter_card":"summary_large_image","twitter_misc":{"Written by":"maisegroup","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.maisetechnology.com\/2021\/11\/05\/this-mac-malware-should-have-users-worried\/","url":"https:\/\/www.maisetechnology.com\/2021\/11\/05\/this-mac-malware-should-have-users-worried\/","name":"This Mac Malware Should Have Users Worried | Maise Technology","isPartOf":{"@id":"https:\/\/www.maisetechnology.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.maisetechnology.com\/2021\/11\/05\/this-mac-malware-should-have-users-worried\/#primaryimage"},"image":{"@id":"https:\/\/www.maisetechnology.com\/2021\/11\/05\/this-mac-malware-should-have-users-worried\/#primaryimage"},"thumbnailUrl":"https:\/\/www.maisetechnology.com\/wp-content\/uploads\/2023\/02\/mac-resized.png","datePublished":"2021-11-05T15:00:50+00:00","dateModified":"2023-02-22T19:21:03+00:00","author":{"@id":"https:\/\/www.maisetechnology.com\/#\/schema\/person\/eb4c832909343bad9b29835cbde276a5"},"breadcrumb":{"@id":"https:\/\/www.maisetechnology.com\/2021\/11\/05\/this-mac-malware-should-have-users-worried\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.maisetechnology.com\/2021\/11\/05\/this-mac-malware-should-have-users-worried\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.maisetechnology.com\/2021\/11\/05\/this-mac-malware-should-have-users-worried\/#primaryimage","url":"https:\/\/www.maisetechnology.com\/wp-content\/uploads\/2023\/02\/mac-resized.png","contentUrl":"https:\/\/www.maisetechnology.com\/wp-content\/uploads\/2023\/02\/mac-resized.png","width":300,"height":225,"caption":"This Mac Malware Should Have Users Worried"},{"@type":"BreadcrumbList","@id":"https:\/\/www.maisetechnology.com\/2021\/11\/05\/this-mac-malware-should-have-users-worried\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.maisetechnology.com\/"},{"@type":"ListItem","position":2,"name":"This Mac Malware Should Have Users Worried"}]},{"@type":"WebSite","@id":"https:\/\/www.maisetechnology.com\/#website","url":"https:\/\/www.maisetechnology.com\/","name":"Maise Technology","description":"Just another WordPress site","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.maisetechnology.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.maisetechnology.com\/#\/schema\/person\/eb4c832909343bad9b29835cbde276a5","name":"maisegroup","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.maisetechnology.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/253b0df440d3cf0019e97554b1e058c6?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/253b0df440d3cf0019e97554b1e058c6?s=96&d=mm&r=g","caption":"maisegroup"},"url":"https:\/\/www.maisetechnology.com\/author\/maisegroup\/"}]}},"_links":{"self":[{"href":"https:\/\/www.maisetechnology.com\/wp-json\/wp\/v2\/posts\/4363"}],"collection":[{"href":"https:\/\/www.maisetechnology.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.maisetechnology.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.maisetechnology.com\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.maisetechnology.com\/wp-json\/wp\/v2\/comments?post=4363"}],"version-history":[{"count":1,"href":"https:\/\/www.maisetechnology.com\/wp-json\/wp\/v2\/posts\/4363\/revisions"}],"predecessor-version":[{"id":4365,"href":"https:\/\/www.maisetechnology.com\/wp-json\/wp\/v2\/posts\/4363\/revisions\/4365"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.maisetechnology.com\/wp-json\/wp\/v2\/media\/4364"}],"wp:attachment":[{"href":"https:\/\/www.maisetechnology.com\/wp-json\/wp\/v2\/media?parent=4363"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.maisetechnology.com\/wp-json\/wp\/v2\/categories?post=4363"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.maisetechnology.com\/wp-json\/wp\/v2\/tags?post=4363"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}