Threat Signal Report

CloudMensis: a New Spyware for Mac

description-logo Description

FortiGuard Labs is aware of a report that a new spyware for Mac was discovered in the field. Dubbed "CloudMensis", the spyware has been active since at least February 2022 and allows an attacker to perform various activities on a compromised machine such as capturing keystrokes, taking screenshots, downloading and executing remote files, and exfiltrating email messages and attachments.


Why is this Significant?

This is significant because CloudMensis is a previously unknown spyware for macOS that can perform various activities on a compromised machine. Also, CloudMensis is equipped with a feature to bypass Transparency, Consent, and Control (TCC), a security feature in Mac, to allow itself to perform nefarious actions involving sensitive data.


What is CloudMensis?

CloudMensis is a new spyware for macOS.


According to a security vendor ESET, a downloader was deployed to the compromised Mac machine once an attacker gains an administrative access through unknown means. The downloader then downloads CloudMensis from a Cloud storage service and installs it on the targeted machine.


The report indicates CloudMensis allows an attacker to perform activities such as:


  • Downloading and executing remote files
  • Exfiltrating email messages and attachments
  • Keylogging
  • Taking screenshots
  • Running searches in removable drives
  • Uploading stolen information to Cloud storages in a password-protected zip file

Also, CloudMensis is capable of bypassing Transparency, Consent, and Control (TCC), a security feature introduced in macOS 10.8 (OS X Mountain Lion), that allows the user to configure privacy settings for macOS apps. TCC usually manifests to the user in a form of a prompt window that asks the user to either allow or deny apps to perform certain actions involving sensitive information such as access to Web cams, microphones and iCloud. The TCC configuration is stored in TCC.db, which is protected by System Integrity Protection (SIP). If SIP is disabled, CloudMensis grants itself a permission by adding entries to the database. If SIP is enabled but the installed macOS version is earlier than 10.15.6, CloudMensis exploits a known vulnerability patched in July 2020 in order to add entries to the TCC database.


What is the Status of Coverage?

FortiGuard Labs customers with the latest (AV) definitions are protected against CloudMensis with the following coverage:


OSX/Agent.BW!tr

Adware/CloudMensis!OSX

Adware/CloudMensis


Definitions

Traffic Light Protocol

Color When Should it Be used? How may it be shared?

TLP: RED

Not for disclosure, restricted to participants only.
Sources may use TLP:RED when information cannot be effectively acted upon by additional parties, and could lead to impacts on a party's privacy, reputation, or operations if misused. Recipients may not share TLP:RED information with any parties outside of the specific exchange, meeting, or conversation in which it was originally disclosed. In the context of a meeting, for example, TLP:RED information is limited to those present at the meeting. In most circumstances, TLP:RED should be exchanged verbally or in person.

TLP: AMBER

Limited disclosure, restricted to participants’ organizations.
Sources may use TLP:AMBER when information requires support to be effectively acted upon, yet carries risks to privacy, reputation, or operations if shared outside of the organizations involved. Recipients may only share TLP:AMBER information with members of their own organization, and with clients or customers who need to know the information to protect themselves or prevent further harm. Sources are at liberty to specify additional intended limits of the sharing: these must be adhered to.

TLP: GREEN

Limited disclosure, restricted to the community.
Sources may use TLP:GREEN when information is useful for the awareness of all participating organizations as well as with peers within the broader community or sector. Recipients may share TLP:GREEN information with peers and partner organizations within their sector or community, but not via publicly accessible channels. Information in this category can be circulated widely within a particular community. TLP:GREEN information may not be released outside of the community.

TLP: WHITE

Disclosure is not limited.
Sources may use TLP:WHITE when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release. Subject to standard copyright rules, TLP:WHITE information may be distributed without restriction.