A cryptocurrency ticker application called CoinTicker appears to be installing two backdoors on Apple Macs, cybersecurity firm Malwarebytes warned Monday.
The app downloads and installs parts of two different pieces of malware – EvilOSX and EggShell – both of which are backdoor applications that can be used to log keystrokes, steal data or execute certain commands. Malwarebytes director of Mac and Mobile Thomas Reed wrote that it is possible the malware was designed to steal cryptocurrency keys.
CoinTicker acts as a legitimate application designed to present the price of a selected cryptocurrency on request. The user installing the app can choose between bitcoin, ethereum, monero, zcash and others, according to a screenshot. However, the app also installs EvilOSX and EggShell in the background.
The app does not require root or other elevated permissions, meaning the user likely will not see any sign of infection.
It's unclear what specifically the app's creators want, but Reed noted that "it seems likely that the malware is meant to gain access to users' cryptocurrency wallets for the purpose of stealing coins."
The fact that the malware is distributed through a cryptocurrency app supports this theory, he wrote.
Malwarebytes for Mac now looks for the CoinTicker app, as well as its malware components, he added.
MacBook Pro image via blackzheep / Shutterstock
The leader in news and information on cryptocurrency, digital assets and the future of money, CoinDesk is an award-winning media outlet that strives for the highest journalistic standards and abides by a strict set of editorial policies. In November 2023, CoinDesk was acquired by Bullish group, owner of Bullish, a regulated, institutional digital assets exchange. Bullish group is majority owned by Block.one; both groups have interests in a variety of blockchain and digital asset businesses and significant holdings of digital assets, including bitcoin. CoinDesk operates as an independent subsidiary, and an editorial committee, chaired by a former editor-in-chief of The Wall Street Journal, is being formed to support journalistic integrity.