FortiGuard Labs is aware of a report that a new spyware for Mac was discovered in the field. Dubbed “CloudMensis”, the spyware has been active since at least February 2022 and allows an attacker to perform various activities on a compromised machine such as capturing keystrokes, taking screenshots, downloading and executing remote files, and exfiltrating email messages and attachments.Why is this Significant?This is significant because CloudMensis is a previously unknown spyware for macOS that can perform various activities on a compromised machine. Also, CloudMensis is equipped with a feature to bypass Transparency, Consent, and Control (TCC), a security feature in Mac, to allow itself to perform nefarious actions involving sensitive data.What is CloudMensis?CloudMensis is a new spyware for macOS.According to a security vendor ESET, a downloader was deployed to the compromised Mac machine once an attacker gains an administrative access through unknown means. The downloader then downloads CloudMensis from a Cloud storage service and installs it on the targeted machine.The report indicates CloudMensis allows an attacker to perform activities such as:Downloading and executing remote filesExfiltrating email messages and attachmentsKeyloggingTaking screenshotsRunning searches in removable drivesUploading stolen information to Cloud storages in a password-protected zip fileAlso, CloudMensis is capable of bypassing Transparency, Consent, and Control (TCC), a security feature introduced in macOS 10.8 (OS X Mountain Lion), that allows the user to configure privacy settings for macOS apps. TCC usually manifests to the user in a form of a prompt window that asks the user to either allow or deny apps to perform certain actions involving sensitive information such as access to Web cams, microphones and iCloud. The TCC configuration is stored in TCC.db, which is protected by System Integrity Protection (SIP). If SIP is disabled, CloudMensis grants itself a permission by adding entries to the database. If SIP is enabled but the installed macOS version is earlier than 10.15.6, CloudMensis exploits a known vulnerability patched in July 2020 in order to add entries to the TCC database.What is the Status of Coverage?FortiGuard Labs customers with the latest (AV) definitions are protected against CloudMensis with the following coverage:OSX/Agent.BW!trAdware/CloudMensis!OSXAdware/CloudMensis
A vulnerability was found in InfiniteWP Client Plugin 1.5.1.3/1.6.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to injection. The attack can be launched remotely. Upgrading to version 1.6.1.1 is able to address this issue. It is recommended to upgrade the affected component.
A vulnerability was found in Itech Movie Portal Script 7.36. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /show_news.php. The manipulation of the argument id with the input AND (SELECT 1222 FROM(SELECT COUNT(*),CONCAT(0x71786b7a71,(SELECT (ELT(1222=1222,1))),0x717a627871,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) leads to sql injection (Error). The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
A vulnerability was found in Itech Movie Portal Script 7.36. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /movie.php. The manipulation of the argument f with the input <img src=i onerror=prompt(1)> leads to basic cross site scripting (Reflected). The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
A vulnerability classified as critical has been found in Itech Movie Portal Script 7.36. This affects an unknown part of the file /movie.php. The manipulation of the argument f leads to sql injection (Union). It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
A vulnerability classified as critical was found in Itech Movie Portal Script 7.36. This vulnerability affects unknown code of the file /artist-display.php. The manipulation of the argument act leads to sql injection (Union). The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
A vulnerability, which was classified as critical, has been found in Itech Movie Portal Script 7.36. This issue affects some unknown processing of the file /film-rating.php. The manipulation of the argument v leads to sql injection (Error). The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
