The same routine, on Linux hosts, validates the operating system distribution by checking the ' /etc/os-release' file. On devices running macOS, Base64-encoded content retrieved from the server is written to a file named '/Users/Shared/AppleAccount.tgz' that's subsequently unpacked and launched as the '/Users/Shared/TempUser/AppleAccountAssistant.app' application. This includes gathering system information, running commands, downloading and executing files on the victim machine, and terminating itself. The first constituent is shared.dat, which, once launched, runs an operating system check (0 for Windows, 1 for macOS, and 2 for Linux) and establishes contact with a remote server to fetch additional instructions for execution. The payloads have been collectively dubbed JokerSpy. Two of the three malicious programs are said to be generic Python-based backdoors that are designed to target Windows, Linux, and macOS systems. The earliest sample dates back to April 18, 2023. The Romanian firm's analysis is based on an examination of four samples that were uploaded to VirusTotal by an unnamed victim.

'As of now, these samples are still largely undetected and very little information is available about any of them,' Bitdefender researchers Andrei Lapusneanu and Bogdan Botezatu said in a preliminary report published on Friday.

Cybersecurity researchers have uncovered a set of malicious artifacts that they say is part of a sophisticated toolkit targeting Apple macOS systems.

Instal the last version for mac Joker