A sophisticated new macOS malware campaign has emerged targeting Web3 and cryptocurrency platforms, employing advanced techniques rarely seen in Apple’s ecosystem.

The malware, designated as NimDoor by security researchers, represents a significant evolution in macOS threats through its use of process injection capabilities and encrypted WebSocket communications to steal sensitive user credentials and financial data.

The attack campaign begins with a familiar social engineering approach, where North Korean threat actors impersonate trusted contacts through Telegram messaging to arrange fake business meetings.

Victims receive fraudulent Zoom meeting invitations accompanied by instructions to download and execute a malicious “Zoom SDK update script” from attacker-controlled domains designed to mimic legitimate Zoom infrastructure, such as support.us05web-zoom[.]forum.

What distinguishes this malware from typical macOS threats is its technical sophistication and multi-layered architecture.

SentinelOne analysts identified that the malware employs a rare process injection technique on macOS, utilizing specialized system entitlements typically reserved for debugging tools to inject malicious code into legitimate processes.

This approach allows the malware to operate with increased stealth and persistence while evading traditional detection mechanisms.

The attack chain deploys multiple components written in different programming languages, including AppleScript for initial access, C++ for process injection, and uniquely, Nim-compiled binaries for core functionality.

This diverse technological approach demonstrates the threat actors’ commitment to developing sophisticated tooling that can effectively compromise modern macOS systems while remaining difficult to analyze and detect.

Advanced Persistence Through Signal Interception

The malware’s most innovative feature lies in its persistence mechanism, which leverages macOS signal handling in an unprecedented way.

Rather than relying on traditional persistence methods like LaunchAgents or Login Items, NimDoor implements a novel approach that monitors system signals to maintain its presence on infected machines.

The CoreKitAgent component establishes signal handlers for both SIGINT (interrupt signal) and SIGTERM (termination signal), effectively intercepting attempts to terminate the malware process.

When a user or system attempts to kill the malware through standard methods, these signal handlers trigger instead of allowing the process to terminate.

Execution chain once the persistence mechanism is activated by a login or reboot (Source – Sentinelone)

The malware then uses this interruption as an opportunity to reinstall itself, writing a LaunchAgent to ~/Library/LaunchAgents/com.google.update.plist and copying its components to ensure persistence across system reboots.

This signal-based persistence mechanism operates through the following code implementation:-

posix_spawnattr_init(&attrp) && !posix_spawnattr_setflags(&attrp, POSIX_SPAWN_START_SUSPENDED);
posix_spawn(&pid, filename, 0, &attrp, argv_1, environ);
kill(pid, SIGCONT);

The malware communicates with its command and control infrastructure using WebSocket Secure (wss) protocol at wss://firstfromsep[.]online/client, employing multiple layers of RC4 encryption combined with base64 encoding.

This encrypted communication channel enables the malware to exfiltrate stolen Keychain credentials, browser data from major applications including Chrome and Firefox, and Telegram chat histories while maintaining operational security against network monitoring tools.

Investigate live malware behavior, trace every step of an attack, and make faster, smarter security decisions -> Try ANY.RUN now

The post New macOS Malware Employs Process Injection and Remote Communications to Exfiltrate Keychain Credentials appeared first on Cyber Security News.