Poseidon Stealer

Contrary to popular belief, macOS devices are not impervious to malware threats. Cybersecurity researchers have identified a new stealer-type malware, the Poseidon Stealer, specifically targeting Mac users.

An Overview of the Poseidon Stealer

The Poseidon Stealer is a sophisticated piece of malware programmed to extract a wide range of sensitive information from macOS devices. This includes files, login credentials, cryptocurrency wallets and other personal data. First identified in the early summer of 2024, Poseidon has been observed spreading through fraudulent Google advertisements, demonstrating its wide reach and the cunning strategies employed by its developers.

Functionality and Capabilities

Poseidon begins by collecting essential device data, such as hardware information, device name, and operating system details, upon infecting a device. This initial step is crucial for the malware to understand the environment it has infiltrated.

Customizable File-Grabbing

According to the promotional material used by Poseidon's developers, this malware boasts customizable file-grabbing capabilities. It can extract content from the Notes application, Photos stored within Notes, and Keychain, which is macOS' native password manager. This flexibility makes Poseidon particularly threatening, as it can be instructed to target specific types of data based on the attacker's needs.

Browser Data Theft

Poseidon also targets data from various browsers, including Google Chrome, Safari, Mozilla Firefox, Microsoft Edge and Opera. The information it seeks includes browsing histories, search engine histories, Internet cookies, login credentials, personal details and credit card numbers. This broad range of targets indicates that Poseidon is designed to maximize the amount of exploitable data it can gather from an infected device.

Cryptocurrency Wallets and More

Poseidon is capable of collecting data from over 160 different cryptocurrency wallets. Additionally, it targets information associated with password managers, FTP clients and VPN clients. While the capability to steal VPN configurations is not fully developed, its inclusion in the promotional material suggests that future iterations of Poseidon could possess this functionality.

The Poseidon Stealer Distribution Methods

One of the primary methods Poseidon uses to spread is through malvertising, specifically fraudulent Google advertisements. Cybercriminals exploit legitimate advertising services to place harmful advertisements over and overove the search engine results. Poseidon has also been distributed via fake websites promoting the Arc browser, with the installers appearing genuine but containing unsafe instructions to bypass security measures.

Other Potential Techniques

While malvertising and fake websites have been the most noted methods of distribution, other techniques are likely. Poseidon's developers are selling the malware on hacker forums, suggesting that the distribution methods may vary depending on the attackers utilizing it.

Common Malware Distribution Methods

Malware like Poseidon often spreads through phishing and social engineering techniques, masquerading as or bundled with legitimate software or media files. Common distribution methods include:

• Drive-by Downloads: Deceptive downloads that occur without the user's knowledge.
• Fraudulent Attachments/Links: Delivered through spam emails, private messages or social media posts.
• Online Tactics and Malvertising: Fraudulent schemes and advertisements.
• Untrustworthy Download Sources: Freeware sites, peer-to-peer networks and pirated content.
• Fake Software Updates: Tricking users into installing fraudulent software disguised as updates.
• Self-Proliferation: Some malware can spread via local networks or removable storage devices like USB flash drives.

The Poseidon Stealer represents a significant threat to macOS users, highlighting that Mac devices are not immune to malware. By understanding Poseidon's capabilities and distribution methods, users can take steps to protect their data and remain vigilant against such sophisticated threats.