{"id":89276,"date":"2025-11-27T07:42:55","date_gmt":"2025-11-27T05:42:55","guid":{"rendered":"https:\/\/digitrendz.blog\/?p=89276"},"modified":"2025-11-27T07:43:00","modified_gmt":"2025-11-27T05:43:00","slug":"flexibleferret-malware-strikes-macos-with-go-backdoor","status":"publish","type":"post","link":"https:\/\/digitrendz.blog\/z\/newswire\/technology\/89276\/flexibleferret-malware-strikes-macos-with-go-backdoor\/","title":{"rendered":"FlexibleFerret Malware Strikes macOS With Go Backdoor"},"content":{"rendered":"
\u25bc Summary<\/summary>\n

– A new macOS malware chain bypasses security safeguards using staged scripts, credential-harvesting decoys, and a persistent Go-based backdoor to maintain long-term system access.
– The malware uses a second-stage shell script that fetches different payloads based on whether the system has an arm64 or Intel chip and establishes persistence via a LaunchAgent.
– A decoy application mimics Chrome permission prompts to steal credentials, which are exfiltrated to Dropbox using fragmented strings and the legitimate API to avoid detection.
– A Go-based backdoor named CDrivers connects to a command server, collects system data, executes commands, and handles errors by pausing before resuming to ensure continuous operation.
– Jamf attributes the campaign to FlexibleFerret operators and advises treating unsolicited interviews or Terminal-based fixes as high-risk to prevent users from manually running malicious scripts.
<\/p>\n<\/details>\n\n

<\/p>\n\n

A<\/mark> sophisticated new malware campaign<\/a> targeting macOS systems employs a multi-stage attack chain to bypass security measures, deploy a persistent backdoor, and steal sensitive user credentials. Dubbed FlexibleFerret<\/a><\/strong>, this threat leverages staged scripts, deceptive applications, and a powerful Go<\/a>-based backdoor to maintain long-term control over infected devices.<\/p>\n\n

Security analysts at Jamf Threat Labs<\/a> recently detailed the attack sequence, which begins with a shell script that determines the system architecture<\/a>, whether it uses Apple<\/a> silicon or an Intel processor, and downloads tailored payloads accordingly. This script retrieves an archive file, extracts its contents into a temporary folder, and quietly launches the next component in the background. To ensure it survives system reboots, the malware installs a LaunchAgent that reactivates the loader every time the user logs in.<\/p>\n\n

As part of its deceptive strategy, the script opens a fake application that mimics Google<\/a> Chrome\u2019s permission interface. This bogus program eventually displays a password window nearly identical to Chrome\u2019s, tricking users into entering their credentials, which are then harvested by the attacker.<\/p>\n\n

Stolen passwords are sent to a Dropbox<\/a> account using a clever evasion method: the malware constructs the Dropbox host address by assembling small string fragments, then uses the legitimate Dropbox upload API to transfer the data. It also contacts api.ipify.org<\/a> to collect the victim\u2019s public IP address, adding another layer of reconnaissance.<\/p>\n\n

In the third stage, a loader script launches a malicious Go-based tool known as CDrivers<\/a><\/strong>. This backdoor generates a short machine ID, checks whether the system has already been compromised, and then connects to a predefined command-and-control server. Once it\u2019s running, it enters a continuous command loop<\/a> that can execute a wide range of harmful tasks, including collecting detailed system information<\/strong>.<\/p>\n\n

To stay operational, the malware includes a built-in recovery routine. If an error disrupts its process, it collects system information again, pauses for five minutes, and then resumes its activity. This design helps the attack continue even when parts of the chain break.<\/p>\n\n

Jamf<\/a> attributes this campaign to the FlexibleFerret<\/strong> group, known for refining their social-engineering hooks. Their tactics often involve fake \u201ctechnical interviews\u201d or bogus \u201csystem fix\u201d instructions that pressure users into running Terminal<\/a> commands manually.<\/p>\n\n

Organizations should treat unexpected interview invitations or troubleshooting steps that require Terminal access as high-risk scenarios. Training users to flag and report these prompts, rather than executing them, significantly reduces the chance of infection.<\/p>\n\n

(Source: Info Security<\/a>)<\/em><\/p>\n\n

<\/p>","protected":false},"excerpt":{"rendered":"

A sophisticated malware campaign named FlexibleFerret targets macOS systems using a multi-stage attack to bypass security, deploy a persistent backdoor, and steal sensitive credentials through deceptive applications. The attack begins with a shell script that identifies the system architecture, d…<\/p>\n","protected":false},"author":1,"featured_media":89275,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_themeisle_gutenberg_block_has_review":false,"cybocfi_hide_featured_image":"","footnotes":""},"categories":[6579,3297,3327,3254],"tags":[127507,127506,79246,22533],"entities":[127510,127511,937,4893,64400,127509,9886,29176,59840,127508,127512,7802],"class_list":["post-89276","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-bigtech-companies","category-cybersecurity","category-newswire","category-technology","tag-flexibleferret-malware","tag-go-backdoor","tag-macos-security","tag-social-engineering","entity-api-ipify-org","entity-cdrivers","entity-chrome","entity-dropbox","entity-five-minutes","entity-flexibleferret","entity-go","entity-golang","entity-jamf","entity-jamf-threat-labs","entity-macos-stealer-campaign-uses-cracked-app-lures-to-bypass-apple-security","entity-terminal"],"_links":{"self":[{"href":"https:\/\/digitrendz.blog\/z\/wp-json\/wp\/v2\/posts\/89276","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/digitrendz.blog\/z\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/digitrendz.blog\/z\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/digitrendz.blog\/z\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/digitrendz.blog\/z\/wp-json\/wp\/v2\/comments?post=89276"}],"version-history":[{"count":0,"href":"https:\/\/digitrendz.blog\/z\/wp-json\/wp\/v2\/posts\/89276\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/digitrendz.blog\/z\/wp-json\/wp\/v2\/media\/89275"}],"wp:attachment":[{"href":"https:\/\/digitrendz.blog\/z\/wp-json\/wp\/v2\/media?parent=89276"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/digitrendz.blog\/z\/wp-json\/wp\/v2\/categories?post=89276"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/digitrendz.blog\/z\/wp-json\/wp\/v2\/tags?post=89276"},{"taxonomy":"entity","embeddable":true,"href":"https:\/\/digitrendz.blog\/z\/wp-json\/wp\/v2\/entities?post=89276"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}