WizardUpdate Adware Updates it Capabilities to Target Mac Users

What are the newly added capabilities?

• deploys secondary payloads downloaded from cloud infrastructure;
• grabs the full download history for infected Macs by using SQLite;
• bypasses Gatekeeper by removing quarantine attributes from downloaded payloads;
• leveraging existing user profiles to execute commands;
• modify PLIST files using PlistBuddy; and
• changes the sudoers list to give admin permissions to regular users.

How does it operate now?

• After infecting a targeted system, it scans for and collects system information that is uploaded to a C2 server.
• The adware deploys a second-stage malware payload, along with a malware variant known as Adload.
• The evasion features cover its tracks by deleting created folders, files, and other artifacts on the targeted systems. Meanwhile, the malware can use existing user permissions to create folders on the compromised device.
• For persistence, hackers use PlistBuddy to create and make changes to Plists in LaunchAgent/LaunchDaemon.

Ending note