Upon initialization, the install script hides visible Terminal windows from the user’s view by leveraging osascript to conceal the installation actions. Early variants of this family used script files named mand. The mounted volume prompts the user to execute an apparent Chrome installation application, but this is actually a malicious script file contained in the DMG. While the DMG file names are masquerading as software and video files, they all share a similarity and result in a mounted volume with the name Application Installer. Once the DMG file is mounted on the machine and the user is tricked into clicking the application icon, an install script is executed to initialize the setup process, as shown in Figure 1.įigure 1. The initial infection vector uses an Apple Disk Image (DMG) that masquerades as legitimate software and video files. The Chrome variant sideloads a malicious Chrome extension with the purpose of hijacking browser activity and delivering custom ad content. At the time of writing, more than 15 unique dropper files have been found for this particular variant. During analysis of the original samples, an additional variant was discovered that targets Safari browser usage and employs a combination of AppleScript and Python to accomplish similar browser hijacking activity. Analysis of the fake Chrome installer uncovered the use of more than 40 unique dropper files to install the extension.

Research began with a variant that uses a combination of known techniques to deliver, persist and sideload a Chrome extension. The CrowdStrike Content Research team recently analyzed a MacOS targeted browser hijacking campaign that modifies the user’s browsing experience to deliver ads.

The CrowdStrike Falcon ® platform provides continuous protection against browser hijacking threats by offering real-time visibility across workloads.

The purpose of the campaign is to inject ads into the user’s Chrome or Safari browser.

CrowdStrike analyzed a new browser hijacking campaign that targets MacOS.

Chrome dmg