Fake TradingView .pkg delivered via YouTube ad installs macOS implant with root CA, TLS interception and keylogging

Linha do tempo

1. safedep.io ↗ · pub. 20/08/2026 21:00 · coletado 19/10 18:03 primeiro registro

   Fake TradingView .pkg delivered via YouTube ad installs macOS implant with root CA, TLS interception and keylogging

   ler a análise desta fonte ocultar

   Researchers at SafeDep analyzed a macOS implant recovered from a compromised workstation. Infection began on 2026-07-26 with a paid YouTube video ad impersonating TradingView that led to a fake .pkg installer. The malware is a remote-controlled task runner, not a single-purpose stealer. It persists via a LaunchAgent that re-fetches a shell stager every five minutes. It combines keylogging, screen capture, keychain theft, UI automation of privacy prompts and a local TLS-intercepting proxy backed by a rogue root CA. SafeDep attributes it, as an inference and not a confirmed fact, to a macOS port of the WEEVILPROXY/JSCEAL family.

   Technical Details

   • Delivery: the ad chain redirected via attacker-owned domains (tradingview.15years-ultimate-utility.com, then 15th-anniversary-free.com) to latest_v19.398.7_setup.pkg (about 2 MB, campaign tag utm_campaign=o429-12.2&bid=MC). The installer used the native Installer.app admin prompt to capture the user's password and wrote it in plaintext to /Users/Shared/.passwd. The .pkg was deleted after installation. The heavier components arrived later over about 24 days through the C2 task channel, which is an inference from file timestamps.
   • Persistence: com.microsoft.service.systemhelperwatcher.v8mgfk.plist (RunAtLoad, KeepAlive, StartInterval=300) runs curl | bash against velvetforge.net, with cedarengine.com as fallback. Both are Cloudflare-fronted. The stager only runs when launched by launchd. It evals arbitrary bash from GET /script (headers X-Machine-Id and an HS256 JWT). A trap re-enables the LaunchAgent on SIGTERM, SIGHUP or SIGINT, and the C2 can stop serving tasks by changing the response MIME type.
   • Payload: a legitimately signed Node.js binary is abused as a signed proxy, with NODE_OPTIONS=--require ./preload.js forcing attacker code to run first. preload.js is obfuscated and decrypts a stage-2 script with AES-256-CBC. Stage 2 decrypts app.js into an 18.6 MB V8 code cache (bytecode only, no recoverable source) loaded via vm.Script with cachedData. The implant speaks tRPC over WebSocket to its C2.
   • Native modules: six N-API modules (Rust, C++) provide global keylogging, ScreenCaptureKit and invisible CGVirtualDisplay recording, keychain and Passwords app export, automated clicking through TCC and Touch ID dialogs, rogue root CA installation into the System keychain (trust_system_certificate), system proxy reconfiguration, and a local TLS-intercepting proxy on 127.0.0.1:49313. A fake SystemUpdater.app facade supports the UI automation across about thirty languages.
   • Data in scope: browser databases, wallet extension state, keychain items, keystrokes, screen content, and all HTTPS sessions that honor the system proxy.

   Remediation

   • Hunt for the LaunchAgent label systemhelperwatcher, /Users/Shared/.passwd, the hidden payload directory, a node-owned listener on TCP 49313, a system proxy set to 127.0.0.1, and non-Apple root certificates in the System keychain.
   • Look in browser history and ~/Downloads for latest_v*_setup*.pkg files with a YouTube referrer and the o429-12.2 campaign tag.
   • Search proxy logs for X-Machine-Id headers going to the C2 domains to find additional infected hosts.
   • Remove the plist, password cache and payload directory from a recovery environment, because killing processes or disabling the LaunchAgent re-arms persistence.
   • Treat the account password, keychain contents, browser sessions and wallets as fully compromised: rotate credentials and remove the rogue CA.
   • Block the listed domains.