Dangerous LightSpy malware now targeting macOS devices – here’s what we know

The infamous LightSpy surveillance framework has made its way to Mac devices after researchers discovered a new version designed for Apple’s operating system.

ThreatFabric experts say they have found evidence of the software being used in the wild since at least January 2024, although LightSpy was previously limited to Android and iOS devices.

As a widespread mobile malware, LightSpy was found to be able to extract contact information from compromised devices, intercept messages from both SMS and iMessages, and track people’s location using GPS location data. It can also access photos, videos and other multimedia data stored on your device, collect device information (model, OS version, etc.) and extract browser data (browser history and the like).

The target was an older macOS

LightSpy attacks typically target people in the Asia-Pacific region, and while the expansion into macOS territory is certainly concerning, there are a few key clues: LightSpy’s activities appear to be limited to test environments, and cybersecurity researchers have “several infected machines.” Furthermore, only macOS 10.13.3 users are targeted, so macOS 14 users should be safe.

To compromise endpoint security, attackers are exploiting two known WebKit vulnerabilities, CVE-2018-4233 and CVE-2018-4404.

The surveillance structure is slightly different from the average malware with the help of various plugins. LightSpy used 13 plug-ins for the Android version, and 16 for iOS.

The macOS version, however, has 10 plug-ins: one for retrieving data from the microphone, one for retrieving information from the browser, one for using the device’s camera, one for downloading files, one for retrieving information from the macOS Keychain, one for identifying other devices in that the LAN itself, one to list installed applications and running processes, one to record screen activity, one to run commands, and one to collect Wi-Fi data.

By Shiny Computer