The Mac and iPhone malware of 2023—and what to expect in 2024

Stealer malware

The most fascinating Mac malware trend of 2023 was the sharp rise in stealer malware. Stealers are designed to exfiltrate sensitive data, often extracted from Web browsers on a victim’s computer. The types of targeted data often includes usernames and passwords, authentication cookies that behave as login credentials, and cryptocurrency wallets.

FakeGPT: Trojanized ChatGPT Chrome extensions hijack Facebook accounts

Several Mac-specific stealer families emerged in 2023. These included MacStealer, Atomic Stealer (aka AMOS, short for Atomic macOS Stealer, which was distributed as part of the ClearFake campaign), MetaStealer, GoSorry, Realst and PureLand. Various incarnations steal passwords, cryptocurrency wallets, authentication cookies, and other files from victims’ Macs.

Stealer malware is often available as “malware as a service,” sold via Dark Web forums and Telegram. It’s commonly delivered in the form of a Trojan horse; typically victims think they’re downloading illegally cracked copies of commercial software, and their Mac gets quietly infected when they run it.

Perhaps the most interesting example in 2023 was Realst Stealer, which the developers updated quickly to improve macOS Sonoma support. This malware was distributed via elaborate social media marketing campaigns for video games, targeting people interested in NFTs (non-fungible tokens) and blockchains. The malware was designed to secretively steal victims’ cryptocurrency.

Mac stealer malware Realst disguises itself as video games, is macOS Sonoma-ready

Mac stealer malware continued to evolve and re-emerge through the year; we reported in September that AtomicStealer, MetaStealer, and Realst all had active campaigns that month.

In December, AT&T discovered and wrote about JaskaGO, which included command-and-control capabilities and thus was arguably one of the most severe stealer samples of the year.

Advanced persistent threats (APTs)

There was a ton of Mac malware that APT groups developed and deployed in 2023. Most of them were attributed to threat actors commonly believed to be operating on behalf of North Korea, including the Lazarus Group and BlueNoroff.

The 3CX VoIP company was compromised in March 2023. The company stated that its “macOS build server was compromised with POOLRAT backdoor” malware. 3CX unknowingly distributed Trojanized copies of its own software that were infected with SmoothOperator malware. Infected computers would connect to a command-and-control server. There was some debate as to who was behind the attack; some reported it was the Lazarus Group, others claimed it was a Lazarus sub-group called Labyrinth Chollima, and still others believed it was UNC4736—another group with ties to North Korea.

KandyKorn, a full-featured backdoor, emerged in October. Security researchers at Elastic wrote about it on Halloween. The malware was reportedly designed to infect blockchain engineers. Elastic attributed this threat to the Lazarus Group.

At least two Mac malware campaigns were attributed to North Korean APT group BlueNoroff, which some believe to be a sub-group of, or at least to have ties with, Lazarus Group. The first was RustBucket, which spread in March via Trojan malware disguised as a PDF viewer. In November, Jamf reported on ObjCShellz, which was presumed to have spread through targeted social engineering attacks, like RustBucket.

In June, an APT group targeted a Japanese cryptocurrency exchange with JokerSpy malware. JokerSpy’s origin was unconfirmed, but malware researcher Patrick Wardle noted that it may have been a North Korean threat actor based on a reused IP address.

JumpCloud reported on July 12 that it had been compromised, and would provide further details of the attack as they were uncovered. Malware used in the attack included FULLHOUSE.DOORED, STRATOFEAR, and TIEDYE. Mandiant investigated, and attributed the attack and malware to UNC4899, a North Korean threat actor that likely corresponds to 2022’s TraderTraitor Mac malware.

In July, Proofpoint wrote about NokNok, a Mac port of GorjolEcho Windows malware. NokNok was distributed via a targeted email campaign. Proofpoint attributed this malware to the Charming Kitten APT group, associated with Iran. Although the company provided hashes for NokNok, the samples have not turned up on VirusTotal or other public repositories.

Apparently an Operation Triangulation implant for macOS (associated with TriangleDB, used against Russian iPhones)

iPhone mercenary spyware

Although most people assume that there isn’t any iPhone malware, that isn’t actually the case.

If you feel you have an elevated need to protect yourself from sophisticated threat actors, Apple users should use Lockdown Mode. This high-security mode is available on Macs, iPhones, and as of late 2023, the Apple Watch, too. It’s a bit inconvenient to use devices with Lockdown Mode enabled, as it’s designed to disable several common features, such as the ability to view PDFs in Safari or sent via iMessage. But, as reported by The Citizen Lab, Lockdown Mode has been proven to limit such malware’s ability to infect iPhones.

Apple banned all antivirus software from the iOS App Store in 2015. But perhaps in the future, at least in the EU given its new rules taking effect in March, we may see the return of antivirus apps that can run directly on iOS. In the meantime, VirusBarrier X9 is the only Mac antivirus utility designed to scan iPhone, iPad, and iPod touch for a wide variety of malware files.

Of course, those are just the most sophisticated forms of malware that affects iPhones. See the next section for threats founds in the App Store.

Potentially unwanted apps (PUAs/PUPs) and fraudulent apps

First, let’s talk about a potentially unwanted Mac app, then we’ll look at iOS and iPadOS threats (which can also be installed on Apple silicon Macs via the Mac App Store).

And now let’s shift to potentially unwanted and fraudulent apps found in the iOS and iPadOS App Stores.

Throughout the year, many mobile app developers engaged in unethical behavior, and somehow their apps were still approved by human App Store reviewers.

One developer published a fake Threads app, designed to look like Meta’s (ostensibly “Instagram’s”) new social network app, that charged exorbitant subscription fees. It was available in regions where the real Threads app had not yet launched, making it especially likely that victims in those regions could encounter it and think it was the real Threads app.

Later in the year, after Elon Musk-owned xAI announced its Grok chatbot (a ChatGPT competitor), Intego reported on multiple fake xAI apps in the App Store—none of which were actually affiliated with the AI startup.

AI’s impact on malware in 2023

It’s undeniable that AI tools similar to ChatGPT have made it easier for less sophisticated coders to write malware. Back in February, we wrote that “ChatGPT is malware makers’ new A.I. partner in crime,” as it had been repeatedly jailbroken (i.e. its guardrails circumvented) to write malware, phishing messages, and other potentially harmful content.

In July, reports emerged about WormGPT, which threat actors were beginning to use to generate phishing e-mails targeted at businesses; we discussed this on episode 301 of the Intego Mac Podcast. WormGPT is specifically designed for black-hat  hackers’ use; thus it’s only available via the Dark Web, making it more difficult for law enforcement to shut down.

How can I keep my Mac safe from malware?

If you believe your Mac may be infected, or to prevent future infections, it’s best to use antivirus software from a trusted Mac developer. VirusBarrier is award-winning antivirus software, designed by Mac security experts, that includes real-time protection. It runs natively on both Intel- and Apple silicon-based Macs, and it’s compatible with Apple’s current Mac operating system, macOS Sonoma.

If you use a Windows PC, Intego Antivirus for Windows can keep your computer protected from malware.

How can I learn more?

For some additional details about of the Mac malware of 2023, you can read Patrick Wardle’s and Phil Stokes’s write-ups.

Each week on the Intego Mac Podcast, Intego’s Mac security experts discuss the latest Apple news, including security and privacy stories, and offer practical advice on getting the most out of your Apple devices. Be sure to follow the podcast to make sure you don’t miss any episodes.