Downloading Zoom or Brave? Could Be New Mac Malware ‘Sonoma’ In Disguise

This story was originally published on HackerNoon at: https://hackernoon.com/downloading-zoom-or-brave-could-be-new-mac-malware-sonoma-in-disguise.
New macOS stealer Sonoma hides in fake StreamYard, Zoom, Slack, and DocSend installers, then steals passwords, browser data, and crypto wallets.
Check more stories related to programming at: https://hackernoon.com/c/programming. You can also check exclusive content about #macos, #malware, #infostealer, #threat-intelligence, #web3, #crypto, #apple, #good-company, and more.

This story was written by: @moonlock. Learn more about this writer by checking @moonlock's about page, and for more stories, please visit hackernoon.com.

A new macOS stealer called Sonoma is circulating as fake installers for everyday work apps such as StreamYard, Zoom, Slack, DocSend, Brave Talk, and similar tools. Behind the disguise, Crazy Evil’s Swift malware phishes the Mac login password with an in-process PAM check (quieter than older dscl tricks), then steals browser data, wallets, and developer secrets.