Attackers, tracked under the REF9134 intrusion set, were able to compromise an unspecified major Japan-based cryptocurrency service provider specializing in Ethereum and Bitcoin trading with the novel JokerSpy macOS backdoor earlier this month, reports The Hacker News. Included in the JokerSpy toolkit is the multi-architecture binary dubbed ‘xcc’ signed as XProtectCheck that monitors permissions for FullDiskAccess and ScreenRecording while evading Apple’s security protections, according to a report from Elastic Security Labs.

Source: SC Magazine