A new malware program that targets macOS users is capable of spying on encrypted browser traffic to steal Attack.Databreach sensitive information . The new program , dubbed OSX/Dok by researchers from Check Point Software Technologies , was distributed via email phishing campaigns Attack.Phishing to users in Europe . One of the rogue emails was crafted Attack.Phishing to look as if it was sent Attack.Phishing by a Swiss government agency warning recipients about apparent errors in their tax returns . The malware was attached to the email as a file called Dokument.zip . Once installed on a Mac , OSX/Dok displays Attack.Phishing a fake and persistent notification about a system security update that needs to be installed . Users who agree to install the update will be prompted for their administrator password . Once the malware obtains elevated privileges , it will make the active user a permanent administrator so the OS will never ask for the password again when the malware executes privileged commands in the background . Dok will also modify the system 's network settings to route web traffic through a proxy server controlled by the attackers and located on the Tor anonymity network . In order for this to work , it also installs a Tor client that 's started automatically . The reason why web traffic is routed through a proxy server is to perform a man-in-the-middle ( MitM ) attack and decrypt secure HTTPS connections . This is achieved by installing a rogue root certificate on the system that is then used to decrypt and re-encrypt HTTPS connections when they pass through the proxy . With this method , users will continue to see the SSL visual indicator in their browser when they access HTTPS websites and the browser will not complain about untrusted certificates . The ability to snoop on HTTPS traffic allows attackers to steal Attack.Databreach sensitive information like passwords for email ; social media and online banking accounts ; credit card details entered on shopping websites ; personal and financial information entered into web forms ; and more . With more than half of all web traffic in an average user 's browser now encrypted , it 's not surprising that attackers are resorting to man-in-the-middle techniques to capture Attack.Databreach sensitive data . This and other capabilities make Dok one of the most sophisticated malware programs targeting macOS to date , not counting spy programs created or used by nation states and law enforcement agencies . `` We have been and still are in direct contact with Apple [ employees ] who are very helpful and responsive , '' Yaniv Balmas , Check Point 's malware research team leader , said via email . `` With Apple ’ s cooperation , we believe this specific campaign is now futile and does no longer pose any threat to Mac users . ''

But sometimes that simple precaution is n't enough . A case in point is a dangerous phishing technique targeting Gmail users that first surfaced about one year ago but has begun gaining steam in recent weeks . Wordfence , the maker of a security plugin for Wordpress , described the phishing attack Attack.Phishing as beginning with an adversary sending Attack.Phishing an email to a target ’ s Gmail account . The email typically will originate from someone on the recipient ’ s contact list whose own account had previously been compromised . The email comes with a subject header and a screenshot or image of an attachment that the sender has used in a recent communication with the recipient . When the recipient clicks on the image , a new tab opens with a prompt asking the user to sign into Gmail again . The fully functional phishing page is designed to look exactly like Attack.Phishing Google ’ s page for signing into Gmail . The address bar for the page includes mention of accounts.google.com , leading unwary users to believe the page is harmless , Wordfence CEO Mark Maunder wrote . `` Once you complete sign-in , your account has been compromised , '' he said . In reality , the fake login page that opens up Attack.Phishing when a user clicks on the image is actually an inline file created using a scheme called Data URI . When users enter their Gmail username and password on the page , the data is sent to the attacker . The speed at which the attackers sign into a compromised account suggest that the process may be automated , or that they may have a team standing by to access accounts as they get compromised . `` Once they have access to your account , the attacker also has full access to all your emails including sent and received at this point and may download the whole lot , '' Maunder said . What makes the phishing technique dangerous is the way the address bar displays Attack.Phishing information when users click on the screenshot of the attachment , he told Dark Reading . In this case , by including the correct host name and “ https// ” in the address bar , the attackers appear to be Attack.Phishing having more success fooling Attack.Phishing victims into entering their credential data on the fake Gmail login page , he says . Instead , all of the content in the address bar is of the same color and is designed to convince users that the site is harmless . `` If you aren ’ t paying close attention , you will ignore the ‘ data : text/html ’ preamble and assume the URL is safe . '' Google said in a statement that it 's working on mitigations to such an attack . `` We 're aware of this issue and continue to strengthen our defenses against it , '' Google said . `` We help protect users from phishing attacks Attack.Phishing in a variety of ways , including : machine learning based detection of phishing messages , Safe Browsing warnings that notify users of dangerous links in emails and browsers , preventing suspicious account sign-ins , and more . Users can also activate two-step verification for additional account protection . '' Users can also mitigate the risk of their accounts being compromised via phishing Attack.Phishing by enabling two-factor authentication . `` What makes this unique is the fact that none of the traditional browser indicators that would identify a possible fraudulent site are present , '' says Robert Capps , vice president of business development at NuData Security . The attack underscores the need for Web browser makers to rethink the trust signals they use to inform users about a danger webpage or exploit . `` How users interpret these signals should be thoroughly understood , '' he says . `` Entraining users to rely on signals may have unintended consequences that attackers can use to exploit customers .

Check Point ’ s mobile security researchers have discovered a new ransomware in Google Play , dubbed Charger . Charger was found embedded in an app called EnergyRescue . The infected app steals Attack.Databreach contacts and SMS messages from the user ’ s device and asks for admin permissions . If granted , the ransomware locks the device and displays Attack.Ransom a message demanding payment Attack.Ransom . Researchers detected and quarantined the Android device of an unsuspecting customer employee who had unknowingly downloaded and installed Charger . The early detection enabled them to quickly disclose the findings to Android ’ s Security team that added the malware to Android ’ s built-in protection mechanisms before it began to spread , ensuring only a handful of devices were infected . Unlike most malware found on Google Play , that contains a dropper that later downloads the real malicious components to the device , Charger uses a heavy packing approach . This makes it harder for the malware to stay hidden . Charger ’ s developers compensated for this using a variety of techniques to boost its evasion capabilities so it could stay hidden on Google Play for as long as possible . These included : The ransom demand Attack.Ransom is for 0.2 Bitcoins or roughly $ 180 and is much higher than what has been seen in previous mobile ransomware attacks Attack.Ransom . By comparison , the DataLust ransomware demanded Attack.Ransom merely $ 15 and could be an indicator of a wider effort by mobile malware developers to catch up with their PC ransomware cousins . Similar to other malware seen in the past , Charger checks the local settings of the device and does not run its malicious logic if the device is located in Ukraine , Russia , or Belarus . This is likely done to keep the developers from being prosecuted in their own countries or being extradited between countries

Imagine turning on your smartphone to send a text and finding this threatening notice instead : “ You need to pay Attack.Ransom for us , otherwise we will sell portion of your personal information on black market every 30 minutes . WE GIVE 100 % GUARANTEE THAT ALL FILES WILL RESTORE AFTER WE RECEIVE PAYMENT . WE WILL UNLOCK THE MOBILE DEVICE AND DELETE ALL YOUR DATA FROM OUR SERVER ! TURNING OFF YOUR PHONE IS MEANINGLESS , ALL YOUR DATA IS ALREADY STORED ON OUR SERVERS ! WE STILL CAN SELLING IT FOR SPAM , FAKE , BANK CRIME etc . We collect and download Attack.Databreach all of your personal data . All information about your social networks , Bank accounts , Credit Cards . We collect Attack.Databreach all data about your friends and family . '' This is the message , word for word , found recently by Oren Koriat and Andrey Polkovnichenko , a pair of mobile cybersecurity analysts at Check Point , a security firm in California . The smartphone on which it appeared was an Android model that had been compromised by smartphone ransomware . Ransomware has become a ubiquitous threat to personal-computer users . Criminals remotely access a victim 's computer and lock all the files using encryption software , offering to unlock the data in exchange for a payment Attack.Ransom . The first ransomware attack Attack.Ransom on a phone occurred in 2013 , according to the Check Point researchers , but until now has been confined to small numbers of victims , primarily in Eastern Europe . Now , the company says , the threat has gained a toehold in the United States . Koriat and Polkovnichenko found the software , which they dubbed Charger , embedded in an app called Energy Rescue , which purports to make a phone battery last longer . `` The infected app steals Attack.Databreach contacts and SMS messages from the user ’ s device and asks for admin permissions , '' the company said in a statement . `` If granted , the ransomware locks the device and displays Attack.Ransom a message demanding payment Attack.Ransom . '' The payment demanded Attack.Ransom was 0.2 bitcoin , or about $ 180 at the current exchange rate . ( The phone was being used for business and did n't contain much personal data ; the owner chose to replace the phone rather than pay . ) The most disturbing part of the attack might be that the app was downloaded from the Google Play store . Android phones can use apps from other sources , but security experts usually recommend that users stick to the Play store to take advantage of the processes Google uses to check the software for safety . `` The main issue here is the fact that such a severe threat managed to penetrate Google 's security and enter Google Play , Google 's official app store , '' says Daniel Padon , another member of Check Point 's research team . `` Most malware that manages to enter Google Play has only slim malicious traits , while Charger is about as malicious as can be . As mobile ransomware try to keep the pace with their cousins in the PC world , we are likely to see more efforts of this sort , endangering users around the world . '' Padon added that this malware was particularly sophisticated , using a number of innovative tactics to evade detection by Google . Google commended the security firm for catching the Charger threat so early . `` We appreciate Check Point ’ s efforts to raise awareness about this issue , '' a Google spokesperson says . `` We ’ ve taken the appropriate actions in Play and will continue to work closely with the research community to help keep Android users safe . '' Ransomware attacks on mobile phones are still relatively rare . One well-known case involved users of pornography apps in Eastern Europe who were targeted by ransomware called DataLust , Check Point says . In those cases , the ransom Attack.Ransom was set at 1,000 rubles , or about $ 15 . There 's evidence that Charger , too , comes from Eastern Europe—beyond the clichéd bad grammar of the ransom note . `` This is likely done to keep the developers from being prosecuted in their own countries or being extradited between countries . '' Ransomware attacks Attack.Ransom are joining a growing list of threats to mobile phone securit

This week researchers found a piece of malware in the wild , built to steal Attack.Databreach passwords from the macOS keychain . Named `` MacDownloader '' and posing as Attack.Phishing , what else , a fake Flash Player update , the new malware was found on the Mac of a human rights advocate and believed to originate from Iran . The malware 's code is very sloppy and appears to have been made by an amateur who took pieces of other 's code and repurposed them . The threat report mentions the following : MacDownloader seems to be poorly developed and created towards the end of 2016 , potentially a first attempt from an amateur developer . In multiple cases , the code used has been copied from elsewhere . The simple activity of downloading the remote file appears to have been sourced from a cheat sheet . The main purpose of MacDownloader seems to be to perform an initial profiling of the infected system and collection Attack.Databreach of credentials from macOS ’ s Keychain password manager – which mirrors the focus of Windows malware developed by the same actors . At this time , it appears the malware is not a threat and the Command & Control server has been taken down . Intego VirusBarrier offers protection from this malware , detected as OSX/MacDownloader . Security researchers found that this malware was originally designed as Attack.Phishing a fake Bitdefender antivirus , but was later repackaged as Attack.Phishing a fake Flash Player update . Once installed , the malware attempts to achieve persistence by use of a poorly implemented shell script , which at the time of writing did not function due to the C & C server being offline . MacDownloader displays Attack.Phishing a fake Flash Player update that offers an `` Update Flash-Player '' button and a `` Close '' button . Unlike other malware of its kind , clicking the Close button actually exists the installer and nothing malicious is placed on the system . If the Update button is clicked though , a malware dialog will pop-up , which is , of course , fake as well . These dialogues are also rife with basic typos and grammatical errors , indicating that the developer paid little attention to quality control . After a user clicks on OK , the software mimics the System Preferences to request the admin password in order to grab more info on the system . If the user enters their password and clicks OK , the software grabs the info , and then it tries to open a remote connection to : MacDownloader collects Attack.Databreach user keychain information and uploads it to said C & C server , including documents the running processes , installed applications and the username and password , which are acquired through a fake System Preferences dialog . The name and password , which in almost all cases are Administrator credentials , give the malware everything it needs to access the keychain information . With access Attack.Databreach to the keychain the sky is the limit , because email account passwords , social network account details , and much more , are all stored in the keychain .

Android users were the target of new banking malware with screen locking capabilities , which was disguised as Attack.Phishing a weather forecast app on Google Play . Detected by ESET as Trojan.Android/Spy.Banker.HU , the malware was a trojanized version of the otherwise benign Attack.Phishing weather forecast application Good Weather . The malicious app managed to get around Google ’ s security mechanisms and appeared in the store on February 4th , only to be reported by ESET two days later and consequently pulled from the store . During its short lifetime , the app found its way to devices of up to 5000 users . Besides the weather forecast functionalities it adopted from the original legitimate application , the trojan is able to lock and unlock infected devices remotely and intercept Attack.Databreach text messages . Apart from doing so , the trojan targeted the users of 22 Turkish mobile banking apps , whose credentials were harvested Attack.Databreach using phony login forms . The infected device then displays Attack.Phishing a fake system screen requesting device administrator rights on behalf of fictitious “ System update ” . By enabling these rights , the victim allows the malware to Change the screen-unlock password and Lock the screen . Users who are not alarmed at this point might be pleased with the new weather widget they can add to their home screens . However , in the background , the malware is getting to work sharing device information with its C & C server . Depending on the command it gets in return , it can intercept Attack.Databreach received text messages and send them to the server , remotely lock and unlock the device by setting a lock screen password of the attackers ’ choice , and harvest Attack.Databreach banking credentials . The trojan displays Attack.Phishing a fake login screen once the user runs one of the targeted banking apps and sends entered data to the attacker . Thanks to the permission to intercept Attack.Databreach the victims ’ text messages , the malware is also able to bypass SMS-based two-factor authentication . As for the device locking , we suspect this function enters the picture when cashing out the compromised bank account , to keep the fraudulent activity hidden from the user . Once locked out , all victims can do is wait until the malware receives a command to unlock the device . If you ’ ve recently installed a weather app from the Play Store , you might want to check if you haven ’ t been one of the victims of this banking trojan . In case you think you might have downloaded an app named Good Weather , check for its icon under your apps . After running anything you ’ ve installed on your mobile device , keep paying attention to what permissions and rights it requests . An app that won ’ t run without advanced permissions that aren ’ t connected to its intended function might be an app you don ’ t want installed on your phone .

Android users were the target of new banking malware with screen locking capabilities , which was disguised as Attack.Phishing a weather forecast app on Google Play . Detected by ESET as Trojan.Android/Spy.Banker.HU , the malware was a trojanized version of the otherwise benign Attack.Phishing weather forecast application Good Weather . The malicious app managed to get around Google ’ s security mechanisms and appeared in the store on February 4th , only to be reported by ESET two days later and consequently pulled from the store . During its short lifetime , the app found its way to devices of up to 5000 users . Besides the weather forecast functionalities it adopted from the original legitimate application , the trojan is able to lock and unlock infected devices remotely and intercept Attack.Databreach text messages . Apart from doing so , the trojan targeted the users of 22 Turkish mobile banking apps , whose credentials were harvested Attack.Databreach using phony login forms . The infected device then displays Attack.Phishing a fake system screen requesting device administrator rights on behalf of fictitious “ System update ” . By enabling these rights , the victim allows the malware to Change the screen-unlock password and Lock the screen . Users who are not alarmed at this point might be pleased with the new weather widget they can add to their home screens . However , in the background , the malware is getting to work sharing device information with its C & C server . Depending on the command it gets in return , it can intercept Attack.Databreach received text messages and send them to the server , remotely lock and unlock the device by setting a lock screen password of the attackers ’ choice , and harvest Attack.Databreach banking credentials . The trojan displays Attack.Phishing a fake login screen once the user runs one of the targeted banking apps and sends entered data to the attacker . Thanks to the permission to intercept Attack.Databreach the victims ’ text messages , the malware is also able to bypass SMS-based two-factor authentication . As for the device locking , we suspect this function enters the picture when cashing out the compromised bank account , to keep the fraudulent activity hidden from the user . Once locked out , all victims can do is wait until the malware receives a command to unlock the device . If you ’ ve recently installed a weather app from the Play Store , you might want to check if you haven ’ t been one of the victims of this banking trojan . In case you think you might have downloaded an app named Good Weather , check for its icon under your apps . After running anything you ’ ve installed on your mobile device , keep paying attention to what permissions and rights it requests . An app that won ’ t run without advanced permissions that aren ’ t connected to its intended function might be an app you don ’ t want installed on your phone .