New macOS Malware Proves Social Engineering Still Beats Cryptography

Security is an arms race. Yet the most detailed cryptographic defenses on the planet get completely neutralized simply by asking somebody to click a single button on their screen, as Jamf Threat Labs recently proved by flagging a malicious macOS campaign utilizing a fake Zoom installer to drop an aggressive infostealer onto unsuspecting desktop machines.

Boring. That sums up the entire attack vector. Victims download a disk image featuring a familiar user icon and the standard drag-to-apps layout we have all seen a thousand times, meaning when the payload lacks a valid Apple developer signature and triggers a Gatekeeper warning, the attackers simply include a helpful background image instructing the user on how to manually override the security prompt in System Settings – effectively teaching their victims how to let them in.

Background daemons harvest sensitive data and phone home every eight seconds while opening a remote backdoor for the malicious operator, proving this threat is brazen, persistent, and entirely dependent on convincing a human to ignore a warning sign designed to keep them safe.

We obsess over memory safety and sandboxing setup while threat actors routinely win by targeting the wetware sitting right between the keyboard and the chair, because no amount of native operating system hardening can completely protect us from our own willingness to bypass security checks just to run an app we urgently need – meaning staying safe online requires a healthy dose of paranoia. Because no amount of native operating system hardening can completely protect us from our own willingness to bypass security checks just to run an app we urgently need – meaning staying safe online requires a healthy dose of paranoia.