Hackers have deployed a novel macOS trojan called RustyAttr that uses an innovative evasion technique by hiding malicious code in extended file attributes (EAs). This method, discovered by Group-IB, leverages custom file metadata to avoid detection and utilizes decoy PDF files to maintain discretion, drawing similarities to previous tactics used by the Bundlore adware in 2020.

Lazarus Group Suspected Behind RustyAttr Attacks

Though no confirmed victims were identified, researchers at Group-IB attribute RustyAttr with moderate confidence to the North Korean Lazarus Group. The technique has proven effective against security tools, as none of the malicious files raised flags on the VirusTotal platform. The malware’s evasion methods suggest that Lazarus may be experimenting with new ways to deploy malware on macOS.

Shell script inside macOS extended attribute
source: 

Are u a security researcher? Or a company that writes articles about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing? If you want to express your idea in an article contact us here for a quote: [email protected]

Source: bleepingcomputer.com