Windows and macOS systems have been subjected to attacks leveraging the novel Go-based information-stealing malware JaskaGO, reports The Hacker News. Threat actors have concealed JaskaGO within fraudulent versions of CapCut, AnyConnect, and other legitimate software, which when installed do not harm virtual machines but facilitate data exfiltration, cryptocurrency theft, shell command execution, running process enumeration, and further payload deployment in other systems, according to a report from AT&T Alien Labs. Moreover, system persistence is achieved by JaskaGO on macOS through a multi-step process that includes self-execution through root permissions, Gatekeeper protection deactivation, and custom launch daemon creation. Details regarding the attack vector for JaskaGO or the extent of the campaign remains unclear but the payload represents the increasing prevalence of Go-based malware, said researcher Ofer Caspi. “Go, also known as Golang, is recognized for its simplicity, efficiency, and cross-platform capabilities. Its ease of use has made it an attractive choice for malware authors seeking to create versatile and sophisticated threats,” Caspi added.
A Multi-Actor Infrastructure Investigation (Mapping the Malware Maze)
Another finding by Fox, related to LummaC2 infostealer sparked an infra hunt that led to many findings. C2 Host Pivot & Windows Server Pattern Following the
December 21, 2024
