A new Mac malware dubbed OSX. SearchAwesome was recently found active in the wild. The malware can perform various malicious activities such as intercepting encrypted web traffic to inject ads. The Adware poses as a legitimate application and installs a certificate, which leverages the legitimate mitmproxy open-source program. This, in turn, can be used by attackers to perform man-in-the-middle (MiTM) attacks on a targeted computer.
"This adware, at first glance, seems to be fairly innocuous, since it’s just injecting a script that serves up advertisements. Looks can be deceiving, though," Malwarebytes security researchers Adam Thomas and Thomas Reed wrote in a blog. " Since that script is being loaded from a server, that server’s content could change at any time. It could change from serving ads to siphoning off user data or redirecting the user to a phishing site."
Unlike other malicious malware that tries to appear legitimate, SearchAwesome has a blank disk image file for the installer. Once this file is opened, the malware installs all the malicious payloads in the background, but only shows the user a request to change the Certificate Trust Settings.
The malware also requests the user to allow modification access to the system's network configuration. It is downloaded by a second stage installer, without the knowledge of the victim.
SearchAwesome installs an open-source program call mitmproxy. According to the researchers, this application can be used by threat actors to intercept, modify and replay encrypted web traffic.
The malware also injects a script loaded from a malicious website at the end of every webpage loaded on the infected computer said, researchers.
If a victim tries to delete the malware-laced spi.app from an infected computer, the spid-uninstall.plist agent will run many other operations to remain persistent on the computer.
Even if the user removes the malware from the computer, OSX.SearchAwesome sets up the computer with tools and proxies that can be utilized in future MiTM attacks.
"Even once the malware is gone, its potential for damage is not over. By leaving behind the tools it used to execute a MitM attack, it sets up a situation where another piece of malware—perhaps one more nefarious than this one—could take advantage of the presence of those tools to do its own capturing of encrypted web traffic," the researchers added.