Potent Atomic credential stealer can bypass Gatekeeper

According to LastPass, malware distributors are using prominent ads to impersonate a wide range of services and infect Macs with a potent credential stealer, with the latest targeting LastPass users. Late last week, LastPass said it detected a campaign that employed search engine optimisation to push LastPass macOS apps to the top of results on Google and Bing, leading to two fraudulent GitHub sites that install versions of Atomic Stealer, also known as Amos Stealer.

The attackers masquerade the malware as the official software being advertised, and the installers can arrive via a downloaded .dmg file; once clicked, Gatekeeper can be bypassed by a CAPTCHA-style trick that asks the user to paste a string into the Mac terminal, where the string is in fact a command to download and install the malicious software.

Dozens of targets have been identified, with impersonations extending to 1Password, Basecamp, Dropbox and others, and researchers have warned of this Gatekeeper-bypassing technique for at least the past 20 months. Users are urged to download software only from official sites and to avoid clicking on ad links, visiting the developer’s site directly instead.