Blog

This Mac Malware Takes Screenshots Of Your Computer

Jan 1, 2019 | Blog

There’s a new malware threat in the MacOS ecosystem called OSX.LamePyre.  If you haven’t heard of it yet, it belongs on your radar.

At the moment, industry experts agree that it’s more of a crude work in progress.  Unfortunately, the danger of crude works in progress is that the hackers continue to develop them, making them a threat that gets worse over time.

In this case, LamePyre is limited to maintaining a back door into the infected system and taking screenshots at periodic intervals and sends them back to the hacker controlling the malware.

The only instance of LamePyre found in the wild so far is one that’s disguised as the Discord messaging app, which is widely used by gamers.  Unfortunately, this poisoned version of Discord doesn’t actually function.  It’s simply a shell that contains an Automator script and displays the generic Automator icon in the menu bar when it’s running.

When a user downloads the poisoned version of Discord, the Automator script decodes the malware payload, which is written in Python. Then, the malware begins taking screenshots at predefined intervals and sending them back to the hacker’s command and control server.

There are two risks then:  First, the hacker who controls the script will see pretty much everything you’re working on.  Second, since it opens a channel between the infected machine and the c2 server, it allows the hacker to inject additional malware onto the system, at will.  Not good.

If you or anyone in your employ uses the Discord messaging app, this is an emerging threat to watch.  Fortunately, it’s easily removed and dealt with (for now), but that could easily change as whomever created the app can easily build it out more completely and make it a significantly worse threat.

FBI Program Tasked with Infrastructure Security Compromised

FBI Program Tasked with Infrastructure Security Compromised

The FBI program tasked with ensuring critical infrastructure security has been compromised by hackers, who now offer access to the program's data on the dark web. The breach was initially disclosed by Brian Krebs of Krebs on Security, who claims that the data was for...

Streamline Your Business with the Latest Smart Home Technology

Streamline Your Business with the Latest Smart Home Technology

Are you a business owner looking to get the most out of your Google smart home devices? If so, you're in luck! Google has enabled its Nest products and Android OS with the initial rollout of the Matter smart home standard. This means that businesses now have the...

Data Breach at Sequoia One Exposes Sensitive Customer Information

Data Breach at Sequoia One Exposes Sensitive Customer Information

What do you do when your most personal information has been compromised? This is likely the question that customers of Sequoia One asked themselves earlier this month as they were informed that the company had been hacked. Sequoia One specializes in the management of...

Cisco Reports Critical IP Phone Vulnerability

Cisco Reports Critical IP Phone Vulnerability

As a business owner, it's important to stay informed about potential vulnerabilities that could impact your organization. Recently, Cisco reported a critical vulnerability, tracked as CVE-2022-20968, affecting its IP Phone 7800 and 8800 Series. This new vulnerability...

Google Chrome Releases Two New Features

Google Chrome Releases Two New Features

Google Chrome is one of the more commonly used web browsers. Over the years, though, Chrome has gained a reputation for utilizing a large portion of a computer's memory. This can be a problem if you're running other resource-intensive tasks and don't want to slow...

Get a Free Consultation

 

Fill out the form below to receive a free consultation and learn how we can make your technology worry-free!

 

Contact Information

  • 39301 Badger Street, Suite 500
    Palm Desert, CA 9221
  • (760) 333-8523
  • info@icn.tech