A Trojan pretending to be a macOS Cryptocurrency ticker called CoinTicker is installing backdoors on Macs .
Once installed, the CoinTicker app allows users to select various cryptocurrencies they want to track. It then adds a small widget to the macOS menu bar to notify the user of any changes.
In the background, however, the application secretly downloads two backdoors to the infected Mac that allow an attacker to take control of the computer.
First documented by a Malwarebytes forum member named 1vladimir, the Trojan connects to a remote host and downloads several python and shell scripts, which when executed download and install two backdoors on the infected computer.
“However, when launched, the application downloads and installs components of two different open source backdoors: EvilOSX and EggShell,” said Thomas Reed, director of Mac & Mobile at Malwarebytes, in a blog post.
The Trojan will download customized versions of the EggShell and EvilOSX backdoors from a Github repository, which it has since taken offline.
It will first download the EggShell backdoor using the following command.
Once finished, Reed states that he will create a launch agent that automatically starts the EggShell backdoor when a user logs into their Mac.
It will then download the EvilOSX backdoor. While executing the download, it will send various configuration options that will be automatically added to the downloaded backdoor.
And this will have created a launch agent so that the EvilOSX backdoor will start automatically.
It is not yet known whether the CoinTicker app is designed solely for malicious purposes.
