New Mac Malware Dubbed “JSCoreRunner” Weaponizing PDF Conversion Site to Deliver Malware

A new Mac malware campaign named JSCoreRunner has been uncovered by Mosyle, which disclosed that the threat achieved zero detections on VirusTotal at the time of discovery. It propagates via a malicious website called fileripple[.]com, which masquerades as a legitimate PDF conversion service to entice downloads.

The operation uses a two-stage deployment: the first stage, FileRipple.pkg, displays a convincing webview of a PDF tool while malicious actions run in the background, and Apple has since revoked the developer certificate for this stage, causing macOS to block the package on launch. The second stage, Safari14.1.2MojaveAuto.pkg, bypasses Gatekeeper’s default protections by avoiding standard signature validation to install without warnings.

Once installed, JSCoreRunner focuses on browser hijacking of Google Chrome, traversing user profiles and creating a malicious TemplateURL object to redirect searches and enable keylogging and phishing site redirections. The article advocates multi-layered security measures and cautions Mac users to avoid unverified online conversion tools and rely on official sources for software. According to Mosyle, the threat underscores the need for enhanced Mac-specific protection alongside routine user vigilance.