Macs Just Got a New Virus

Yikes - It's called the "Atomic MacOS Stealer".
⇒ Become a channel member for special emojis, early videos, and more! Check it out here: kzbin.infojoin
Cyble Blog Post: blog.cyble.com/2023/04/26/thr...
▼ Time Stamps: ▼
0:00 - Intro
1:23 - Virus Details and Capabilities
3:34 - How the Virus Works
▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬
Merch ⇨ teespring.com/stores/thiojoe
⇨ / thiojoe
⇨ / thiojoe
⇨ / thiojoetv
My Gear & Equipment ⇨ kit.co/ThioJoe
▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬

[@ThioJoe]

Many have pointed out I should not have used the terms "virus" and "malware" interchangeably, so I will try to be more accurate in the future.

[@anon_y_mousse]

Technically, a virus is malware. While it has a more specific meaning and thus it's akin to the standard comparison of a square and a rectangle, I'd say in this instance you're good.

[@olivesouch6423]

I wish MacOS should have official antivirus.

[@PythonPlusPlus]

@@anon_y_mousse The problem is that this is not a virus, it is a trojan. Viruses are designed to alter or destroy data. Trojans are used to steal data.

[@NaraSherko]

So what is it then

[@DrCody227]

You can only use the term virus if it is self propagating. To this day no one has ever seen a "virus" on a Mac. Spyware and malware on the other hand...

[@5H4D0WOfficial]

Bruh, Malware just became a monthly membership 💀

[@adityapareek_]

😂

[@DenOfTimbsllc]

I swear, even when I get hacked, I still have to pay a monthly subscription!

[@MarcosRobertoDosSantosJF]

Yeah, I want my malware as a perpetual license again! Hahah!

[@Up2Speed]

@@DenOfTimbsllc Imagine ransomware where you have to pay $5/month or else your entire PC gets nuked.

[@theblitzminecraft]

yeah many people are mad at adobe for thier stupid memberships, and now even hackers are mad at each other for the same reason

[@tuckfuddyduddy]

One true thing in tech/IT is that there is no such system is safe and invulnerable against threats.

[@volvo09]

Yep, "security by obscurity" is how smaller OS use bases stay "virus free", but it's just because no one has taken the time to find exploits unless it's a state sponsored attack on a niche system or individual.

[@MarkMcCoolJr]

as the saying goes, the only secure system is one that no one is allowed to login to.

[@HeroRareheart]

Even airgaped systems can be vulnerable although that is significantly harder to achieve.

[@jamieever4046]

Not unless you create your own system not compatible with any popular files and you lock it in your basement on an old computer so nobody knows about it and it can't connect to the internet

[@stio_studio]

​@@jamieever4046 Someone takes your electricity :P

[@jimmlmao]

This virus also has a streaming service for watching victims for just $39.99/month

[@GlenHunt]

Payable in stolen crypto

[@norseczar27]

Hehe

[@tensixtyoclock]

You're a victim yourself if you pay those 40 dollars

[@LitoMike]

bruh

[@Defensive_Wounds]

Not with my old ASUS with blu tack over the camera!

[@TheVirus145]

There is a possibility that Apple already patched this with the latest "Rapid Security Response" 13.3.1 (a). It was the first time Apple used this way of patching security vulnerabilities and they have not disclosed what exactly they fixed. Given the timing, it would make sense. Patch 13.3.1 (a) was released on 1st May

[@ThioJoe]

Possibly, but I’m not sure there’s anything to really patch unless it uses an exploit

[@DenOfTimbsllc]

@@ThioJoe, they mentioned a WebKit exploit that they found, but we have no clue what that exploit is exactly.

[@Bob-1802]

Apple never disclosed what they patched.

[@DidanSetia]

Probably, yeah. But, the Rapid Security Response deployed not only for macOS, but for iPadOS as well. I’ve just done the update a few hours ago actually.

[@Juanguar]

@@DidanSetia iOS too Since it has been pushed to everything it’s safe to assume it has something to do with WebKit

[@prayhe]

To be exact, a DMG file is a disk image file which could contain anything. It is mostly used to ship applications in it with the background picture changed so it tells you what to do to install it. Because applications on a mac appear to the user like a single movable file it mostly tells you to drag and drop that application file onto a shortcut which is linked to the macs application folder. That way it appears in your dashboard etc. and is „properly installed“ (although you COULD just execute it from the dmg aswell) It seems they are taking advantage of people being used just following whatever the background of that dmg file says to make them execute their malware. Either its an application inside a dmg file OR an actual installer (.pkg file) but not the mix of both these bad actors have shipped

[@Heeter]

My Big-Mac got a virus?!!!!?! I'm suing McDonalds now!

[@anthony17mapoy46]

Oh really? 🤣

[@thelastofthehitachi972]

stroke! stroke! stroke! - stop mocking me!

[@zozonajjar1234]

Hahah😂

[@huyong5890]

1:15 Vietnamese people here. Great job on pronuncing it correct as most Americans may mispronounced into f word. Great job Thio Joe

[@electricspider2267]

Reminds me of that time someone had to provide proof that their name was "phuc datbich" before facebook allowed them to use it

[@therealhussein]

Thio is a gigachad literally just explains what's going on in a clear way then disappears until he uploads something, huge respect

[@Hercules718]

this is ALL a lie

[@kinsley7777]

guess that explains the rapid response update yesterday … thank YOU … you just saved me trying to find out what it was all about

[@TheOriginalMacOS]

well to be fair it would be weird if a random ass app from telegram started asking for root privledges and file access.

[@GE1463]

get out of here this is a windows channel

[@iLife64]

OSX viruses are rare but when they come out they hit hard

[@itsROMPERS...]

"OSX"? That term hasn't been used in years on Mac.

[@ArizeOW]

@@itsROMPERS... it's literally being used in this video. Also, who are you to decide how people communicate? OSX is still commonly used to refer to macOS in my bubble.

[@Blitterbug]

@@itsROMPERS... It's used more often than 'pedant'

[@itsROMPERS...]

@@Blitterbug I never said it wasn't used often, i said it was WRONG because Apple changed the name in 2016. You can call your MacBook a "PowerBook", because Apple did call its laptops by that name decades ago, but they don't anymore, so it's wrong. OSX is just not what it's called by its maker anymore. What is hard about this?

[@Blitterbug]

@@itsROMPERS... You miss my point somewhat ;) I'm saying it's pedantic to quibble. To many seasoned Unix developers like me it'll always be OSX, not the trendy MacOS.

[@CactiPlayz]

Thanks for the info!!

[@AaronShenghao]

Apple: It’s impossible!

[@Ksanimations]

Lol

[@olivesouch6423]

Microsoft: "let me do it for you"

[@Hardcorelactation]

@@olivesouch6423 kermy

[@false_positive]

Linux: **grabs popcorn and sits back**

[@false_positive]

@DarkDev they sure do, that’s why there is clamav 🙂

[@MXALOVE]

When I had a Mac I knew not many viruses were made for it, but I also knew there were at the same time, so IMO it's the same usage because either way, you never know when you could get something.

[@pcc678]

OK Joe - You left out the most important part: How do you know if your Mac is infected, and how to remove the virus!

[@QuixoteX]

I have never seen a Mac installer that has you right click and select open. Usually they have you drag something to a folder.

[@randomriddle539]

Appreciate the info

[@SamarthCat]

The problem with macOS and linux for security is that if an app has your password, they can invoke any process as sudo. On windows, if an app has the password, they can't do anything, they still have to open the UAC prompt.

[@unicorn_tamer]

Yes, and once they do that, the sheep are of course going to click Yes. And you don't really need to do much to gain admin privs in Windows anyways. Linux has a much more secure design by default and privilege management is a hundred times better there.

[@keit99]

Also not every user has sudo active for them ( doesn't mean the point isn't valid )

[@GeorgeHafiz]

But even being root/sudo is not enough to access certain areas of macOS. That’s why as shown in the video, even though the virus is given the user’s password, there’s still a pop up to access various folders.

[@mpdkevg]

Awesome video ThioJoe! Very informative! You mentioned considering buying a biometric authenticator. What are some of the better ones?

[@Mainyehc]

Apple’s own Magic Keyboard with TouchID? That’s the safest one, at least…

[@tmcarter3]

Great content! You literally just saved me two users of MACs with this detection alert. Thank you!!!

[@Mopsie]

Thanks for keeping us in the loop. This video actually gave me some reassurance that my security is fine. Just don’t install random crap and don’t always press allow and accept. Seems kind of obvious to me. But I can see how other people can fall for this.

[@frostmoonplayer]

macOS or Windows, you just don't click on a random link, don't open attached files from an unknown sender, don't allow disk access to random apps you found online. I feel cybersecurity should be taught in school by this point.

[@louthecoder]

I love how the title makes it sound like a new game or something just came out. I'm just imagining Thio saying "Eyo guys, Macs just dropped a new virus, only 50 have been made, so go buy them asap."

[@el_dallasyt]

Thanks for the info joe

[@paulguy2545]

Thanks for the heads up 👍

[@Sparcky_Ancientpack]

I never encountered a virus that bad, but once I did encounter a browser that hijacked my favourite browser safari and all I could use was yahoo as a search engine and luckily, after a while, I was able to get rid of it and it's been a long time and I was wiped at Mac a couple times after

[@NaraSherko]

"Macs dont have viruses" The macs:

[@officially_s]

What if I might have already installed such an app in my Mac in the past? Is there a way to fix it?

[@pinkshortcomedy]

I love learning about viruses for an OS I don't and probably will never use! jkjk I love these kinds of videos, keep it up!

[@mjtallon7101]

Appreciate the update. It's basically always been true that Macs aren't invulnerable to viruses, there are just fewer viruses that target them. We could all use a reminder once in a while to be vigilant. But no, I've always been too terrified to download anything I'm not 100% sure is from a reliable site.

[@F_L_U_X]

1:12 lol @ the side note

[@Peekofwar]

I seem to remember someone in one of my elementary schools (primary school) arguing that Macs don't get viruses... I think it might've been the teacher of the computer lab. I was smart enough to know that couldn't possibly be true.

[@dave1ahc]

I am a Mac user and have been for quite sometime also do windows but I don’t think that you went over. How do you get rid of the virus if you get it

[@johnwpierce3]

Had to head to the comments to see if anyone else caught this definition reassignment. Conflating a virus with a user initiated exploit is a stretch. I don't normally engage in splitting hairs over definitions, but in this case I will. The marketshare argument is a mass adoption of a flawed opinion. Just because Mac or Linux does not have the same adoption rate that Windows does, does not mean that there is not an incentive to create "programs" of malicious intent on the others. There is now and has always been many different incentives to create programs for all three platforms, and the different motivations (financial, foss, watch the world burn) are shared as well. Windows it is pretty much the only operating system that has suffered from viruses (self-replicating malware). Sure, exploits exist across all platforms; if a bad actor, government really wants to spy on you, it will. Windows obtained this reputation not because of market share, but because of an engineering decision. Security was and always has been secondary (or non-existent) to "ease of use" in order to achieve Mass adoption. Microsoft lives by the philosophy, run now ask questions later. 😂 *nix has a super user, nothing runs accidentally. sure it can be exploited and hacked, but it is a no-mans-land for "viruses."

[@RDFContent]

Whats the best AV for MacOS?

[@BrennerEraFan]

So if I see a popup, I should try entering a wrong password first.

[@davldbradley6073]

All friends that my have iOS like me I’ve got a XR older iPhone but the same thing Right? Or are phones different?

[@stingus]

The HOLY RULE of computer security is to be extremely cautious about using promoting root/admin privilegies to ANYTHING. If you are going to permit the admin access, remember, you're handling all the keys to your computer to the requesting programm. Permit the admin access to an app only if you are ABSOLUTELY sure it's safe. The app with admin rights can do absolutely everything on your computer - it can take anything it wants and it can ruin your OS so you'll end up reinstalling the whole computer. The best practice I came to after years of computer fixing is to not to give admin password to the owner of the computer. If the owner needs to install something - owner just calls the specialist and he installs everything. You may end up newer give up the password to the computer owner if doesn't need it at all and he'll be using that computer for many years without a single issue. If the owner needs the admin privs from time to time for some reason, you can give it to him after making sure he understands importance of the admin privileges and knows that he shouldn't ever use it if he's not sure about safety. This way he'll make couple of mistakes in the process and will become a great computer user that knows what he's doing and has no computer problems. Sure you have to explain the other good practices to the user as well, but this topic is the far most important one.

[@anon_y_mousse]

Personally, I avoid password managers and instead I base my passwords on some phrase relevant to the site I'm logging into and then alphabet shift it. So they're easy to remember but impossible to guess.

[@Boomin4u]

Those prompts would be signaling alarms in my head

[@_SJ]

0:25 Windows is declining and "Unknown" OS on the rise. I wonder what are those unknown ones

[@ethimself5064]

Smaller OS systems for basic uses

[@ThioJoe]

Yea I was wondering that myself

[@_SJ]

​@@ThioJoe Same 😅

[@ethimself5064]

@@ThioJoe Look up

[@ethimself5064]

Ha, ya did

[@guacfiend]

i sometimes forget that theojoe was the original troll 10 years ago

[@masterincredible1427]

I downloaded Tor a few days ago. What should I do

Doing tech support for my friends, it is kind of insane how much maleware there is on apple devices lately. Never had problems until about a year ago. Now, I have dealt with 4 devices that got maleware. Their "defender" software doesen't seem to be the best honestly. Ironically, it was a long time ago where I had to remove maleware from windows. But my windows user friends are also a bit more tech savy because their hobbies are gaming.

[@Teluric2]

Can you elaborate on your apple devices? Strange behaviour? Kernel panic?

[@suzieq8379]

I need help Ive never done a backup on my macbook pro I bought it is 2016 still runs good but I think I have a virus ? I want to back it up on external drive but if I do so will that infection come back if I restore it to the state as I bought.. Reading comments you all seem to pretty much know all about the Mac I can't find a video that tells this.. in my network settings on win (local) netbios it says the name of my macbook is currently being used, could be wifi I dunno? Anyone?

[@GE1463]

Thanks ThioJoe

[@maryajaniak2896]

I have a Chromebook and I have anti-virus and internet security software as well as a VPN so am I safe if I have a MacBook on it too. (I don't have a Mac Book yet but I'm getting one soon). But I don't usually go on unusual sites or open weird e-mails.

[@chimee1237]

Well my dads word document containing all his passwords is no longer safe😅😂

[@_Trakman]

what's a good mac AV?

[@ottergauze]

I'm surprised Keychain has TOTP key support. Putting passwords and TOTP in the same place is practically asking for trouble.

[@joshuapettus6973]

Especially in a place that is only protected with something as weak as the system password (Most people type that in constantly so they generally use weak ones). Password manager should use a separate password, which is why people should use Keypass over the OS or built in Browser one.

[@neetop1557]

@@joshuapettus6973 or even weaker, e.g. your face or fingerprint.

[@100PercentTHCfilmsX420X]

ThioJoe how common do you think malware is on Linux distros?

[@morgan0]

would be cool to see you do a video on objectivesee’s software, they make anti-malware tools, dunno if you have a mac to throw malware at the software but yea

[@RedLuigiE]

One thing you can do is type an incorrect password, and if it's legit it'll say "nope thats not your password" but if it's a virus and doesn't know your passowrd or isn't going through apple's apis and stuff it'll just accept that as your password and fail stuff that requires passwords.

[@prayhe]

malware creators be like: ok let’s do it so it only accepts the password on the second attempt :D

[@GRBtutorials]

@@prayhe Or just check the password.

[@RedLuigiE]

fr

[@roseydeep4896]

caught this vid in 5 seconds!! Fellow mac users gotta watch out!!

[@jim9463]

Clicked as soon as I saw it 😂

[@definitely-not-daniel]

I knew I was not going mad. A few weeks ago i thought I was hacked but this makes so much more sense. I literally reset everything and have been increasing my security processes to this day 💀. I had the felling it was something related with keychain and I did have motion before so I wouldn’t be surprised if this were it.anyone knows if it also was designed to affect iOS too?

[@anantav51]

iOS doesn’t work the same way

[@GE1463]

There is a version for IOS. But IOS isn't virus proof eather

[@definitely-not-daniel]

@@GE1463 oh I definitely. While much more secure it is absolutely not airtight. No system is really. I don’t know what I got but it certainly affected my Mac, iPhone and iPad. Idk what it was but it sure made me a bit paranoid for a while. 💀

[@joshuarmost]

All my head in the clouds Mac friends need to watch this

[@jasperwright9237]

Good job, thanks.

[@liamsz]

As a Mac user, that pop-up looks really sketchy and is completely different from any other gatekeeper pop-up macOS uses, also macOS is spelled wrong (the m is capital, small mistake but not something Apple would do) also it says System Preferences, which does not exist anymore Pretty much any savvy Mac user would instantly see this as malware but I think multiple people could easily fall for this and not notice it, I hope Apple adds a security feature to prevent users typing in their mac passwords in text fields that aren’t from gatekeeper or the terminal

[@Ms_Cheesecake]

Most of the people I know who use Macs are those who are absolutely not tech-savvy. :( They'd easily fall for it.

[@TakZ000]

Sometimes people would just zoom past all popups specially when they are in a hurry or not attentive enough.

[@neetop1557]

If you downloaded this sht from some dodgy place on the internet you're in either of 2 groups: - you downloaded it on purpose knowing that it's dodgy, e.g. to test it - you downloaded it because you're clueless and no amount of prompts will make you think about whether you're doing the right thing.

[@GE1463]

1. Don't get a Imac.

[@fearandil__]

@@GE1463 iMac …

[@Antor_Einstein]

your video is great bro

[@tomsmith8515]

PLEASE an update video on mac virus in total.... check if you are infected and what to do... and so forth...

[@LitoMike]

me randomly feeling the name to download this and put random insults in the password thing:

[@ClayAsbury122]

It's not just smaller market share , Macs aren't invulnerable, but they objectively are more secure simply because Apple writes the operating system for just 5-6 configurations of their own hardware. Windows relies on thousands of vendors to make it run on everything. There is no comparison in terms of avenues of attack

[@Blitterbug]

You're confusing the reasons for their better reliability and stability with resistance to infection. No IT pro would make this mistake, even though you make great points about the OS being inherently more crashproof.

[@Peekofwar]

1:26 - Wait, did they forget about Safari; the default browser on MacOS?

[@williamgates4399]

So, you don't provide any solutions on how to remove this from a mac?

[@TIPDYT]

Remember, Mac doesn't get viruses - Apple

[@jim9463]

It’s not a virus, it’s an app that is not very honest

[@electricspider2267]

It's not a dshonest app, it backs up all your passwords and other stuff... that feature is just unlisted. Like how photoshop can remember your settings.

[@Splarkszter]

This thing can also affect every single operating system, every single one. We need something done about this.

[@polardiscoball]

still beatz staring at windowz it's like 1996 in there! 😳

[@Gerenocidiac]

I install a few web downloaded applications on my MacBook Air, but the instant any application asks me to enter my password, I cancel and delete. Not worth the risk if I'm also taking a risk by installing outside of Apple's ecosystem. I hope github stuff remains relatively safe as I do use that a lot, but it's only with very high user count things such as ytdlp, and some retro decompilation items.

[@GE1463]

You have a macbook? Oof. I hope you get better!

[@Gerenocidiac]

@@GE1463 It serves a purpose. I still have my desktop PC for my primary uses.

[@ahaanjain5877]

nice video though. thanks for the info

[@cowboy7684]

How long has this malware been out

[@TomBalint]

The last and only time I got a virus on a Mac was about thirty years ago. I used to buy and use virus software but it seemed so useless I stopped using it. Hopefully I don’t come to regret that. After thirty years of no viruses it’s difficult to start using them.

[@Mnogojazyk]

I am a Mac user; I was introduced to them through work. I have had virus protection about twenty five years, originally through work but later through my own efforts. To date I have not suffered a virus, Trojan horse, etc. but I have stayed away from unfamiliar sites. Am I invulnerable? Certainly not.

[@Lampe2020]

This thing is kinda like Redline but Mac edition XD

[@thejpkotor]

Is there anything good that comes out of Telegram?

[@macrichterj19]

I use Webroot Secure Anywhere but also diligently making sure not click on stuff that would do something like this.

[@randomsliceofcakeofficial]

I don’t even have a Mac but I’m still watching. Lol

[@chrisblack6258]

That's a lot of DMG

[@suzieq8379]

my network and macbook have been hacked by bluetooth global or something as of Sept 15, it has I can't count the plugins I have Exec , or Unix is installed and I want it gone.. My Netbios tell me my computor is being used by someone else, my wifi is all messed up they are in my iphone, turning my bluetooth on

[@CharlieMartorelli]

Thanks!!!

[@silika82]

If 2fa involves a text to your cell phone which you have to allow then they can’t get round that can they?

[@ThioJoe]

No sms is not the only form of 2FA. You can use rolling codes with authenticator apps like Google Authenticator, or load them into keychain, which is what i’m talking about.

[@volvo09]

2:16 I just have to stop here.... AUTOMATIC filling of 2FA codes? That's defeating the whole purpose of 2FA.

[@lucaswiese6]

We Now need 3FA (3 Factor Authentification)

[@volvo09]

@@lucaswiese6 then someone will create a 3FA auto filler, all under a single password 😂 Edit: and then they'll wonder why they got hacked.

[@lucaswiese6]

@@volvo09 no, impossible, the 3rd factor is Face ID using the camera / Touch ID using a finger print sensor

[@RowanBird779]

Me on my 2012 Dell XPS laptop running Windows 7: "that's nice"

[@ygt-cd3mg]

Mac user here, never believed mac had no virus, so never lower my guard down. giving this is happening all the time, What your take on EU force apple to allow side loading apps.

[@GE1463]

Get a windows PC or get out

[@Juanguar]

I was always skeptical about Mac antivirus software but now you convinced me to finally get one Thanks thio

[@GE1463]

or dont get a mac lmao

[@noahtorocalzado]

@@GE1463 get a pc? bruh, the same virus you will get there lol

[@giovannirocket3480]

Does this include iphones and iPads?

[@yanndooms8892]

What is that "Unknown" os?

[@ThioJoe]

I was really wondering that myself

[@emerelle3535]

I'm a MacUser, and that concerns me a little bit since I used the keychain as mention also for 2fa, so onetime-passwords + username + password are all in the same place. (Maybe not the best idea to begin with). Usually I try to get my software from the App Store but yeah, I'll be definitely a little bit more alerted now. :P I lately "secured" my Apple ID with Security Keys, but if you have the password on a logged in device, you can simply remove then, so this wouldn't protect anything either...

[@vekidev]

me with no internet and a new mac: ok cool, im gonna go back to playing pacman i have installed

[@GE1463]

me who bought a new mac just to burn it and flip off the apple logo: 😄

[@PTKoMonsterZ]

Hallo your combooter has virus.

[@byrd203]

Joe also please let people know to turn off auto open files after downloading so if they download something fake it does not not at lest mac has that to help some what

[@realvolteon]

Thats just the news you want to hear, right after getting yourself a brand spanking new Macbook!

[@ELIAS-og5vf]

❤ i love your vidéo, i have question how do you write your vidéo , i want to know How do you make thé subject , are you using App or display text

[@CH40T1C_TW1NKL3]

Help I’m scared,I’m not sure if it’s a scare ware or not,it says “YOU HAVE DOWNLOADED A MAC VIRUS! PRESS OK TO START REMOVAL”

[@repatch43]

Based on my understanding this thing doesn't self propagate, so it's not a virus, just your standard malware

[@Babavose]

Cute virus that asks you to type your password 😀

[@b0ilerboy]

Have you experienced the new KZbin adware virus on Mac’s? I have and it sucks I am still trying to resolve the problem.

[@AkronBurbGuy1]

Yikes 😬

[@BrennerEraFan]

Could you make a video about securing everything with a level only NERDS would do, and maybe using a USB stick to authenticate yourself?

[@ashleyrose.]

I always say, if it connects to the internet, it can be infected