September 23, 2019 By David Bisson 2 min read

A new Mac malware family is masquerading as a legitimate trading app to steal victims’ data and then upload it to a website.

Trend Micro found two samples of the Mac malware family, detected as Trojan.MacOS.GMERA.A, both disguised as the Stockfolio trading app.

The first sample arrived as a .ZIP archive file that contained a copy of the Stockfolio app modified with the attackers’ own digital certificate. When executed, the variant displaced the trading app interface while it performed its malicious functions in the background. These capabilities collected users’ system information, encoded it, saved it in a hidden file and then uploaded it to hxxps://appstockfolio.com/panel/upload[.]php, a domain that was active in January and February.

The researchers used the digital certificate of the first malware sample to detect the second version. That iteration also contained an embedded copy of the Stockfolio app that used the attackers’ digital certificate, and launched the app in a similar way to disguise its malicious intents. Even so, the variant came with a simplified routine and established persistence by creating a property list (plist) file.

A Summer of Mac Malware Campaigns

Trojan.MacOS.GMERA.A isn’t the only Mac malware family that has made headlines in 2019. In June, Malwarebytes detected a threat called Bird Miner that hid within the cracked installer for Ableton Live music production software to infect Mac users with a cryptocurrency miner. Around the same time, Intego spotted malware called CrescentCore posing as Flash Player and using several evasion techniques to avoid detection. Shortly thereafter, Intego observed a threat named NewTab attempting to inject itself into the Safari browser.

How to Defend Against Trojan.MacOS.GMERA.A

Security professionals can help defend against Trojan.MacOS.GMERA.A and similar threats by creating a security awareness training program that educates employees on the tech they’re using and encourages them to download apps only from trusted developers on official app marketplaces. Security leaders should also consider investing in a mobile device management (MDM) solution that applies to internet of things (IoT) products and integrates with existing security tools.

More from

Widespread exploitation of recently disclosed Ivanti vulnerabilities

6 min read - IBM X-Force has assisted several organizations in responding to successful compromises involving the Ivanti appliance vulnerabilities disclosed in January 2024. Analysis of these incidents has identified several Ivanti file modifications that align with current public reporting. Additionally, IBM researchers have observed specific attack techniques involving the theft of authentication token data not readily noted in current public sources. The blog details the results of this research to assist organizations in protecting against these threats. Key Findings: IBM research teams have…

X-Force Threat Intelligence Index 2024 reveals stolen credentials as top risk, with AI attacks on the horizon

4 min read - Every year, IBM X-Force analysts assess the data collected across all our security disciplines to create the IBM X-Force Threat Intelligence Index, our annual report that plots changes in the cyber threat landscape to reveal trends and help clients proactively put security measures in place. Among the many noteworthy findings in the 2024 edition of the X-Force report, three major trends stand out that we’re advising security professionals and CISOs to observe: A sharp increase in abuse of valid accounts…

How I got started: Cyber AI/ML engineer

3 min read - As generative AI goes mainstream, it highlights the increasing demand for AI cybersecurity professionals like Maria Pospelova. Pospelova is currently a senior data scientist, and data science team lead at OpenText Cybersecurity. She also worked at Interest, an AI cybersecurity company acquired by MicroFocus and then by OpenText. She continues as part of that team today.Did you go to college? What did you go to school for?Pospelova: I graduated with a bachelor’s degree in computer science and a master’s degree…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today