{
  "name": "An Update on Fake Updates: Two New Actors, and New Mac Malware",
  "slug": "an-update-on-fake-updates-two-new-actors-and-new-mac-malware",
  "description": "Proofpoint has identified two new cybercriminal threat actors, TA2726 and TA2727, operating web inject campaigns. TA2726 acts as a traffic distribution service for TA569 and TA2727, while TA2727 delivers various malware payloads including a new MacOS information stealer called FrigidStealer. The landscape of web inject campaigns is expanding, with multiple copycat actors using similar techniques, making it challenging to track distinct activities. These campaigns typically involve malicious injects, traffic distribution services, and ultimate payloads, sometimes managed by different actors. The attacks use fake browser update lures to deliver malware to Windows, Android, and now Mac systems.",
  "published": "2025-02-18T14:38:48+00:00",
  "created_at": "2025-02-18T14:38:48+00:00",
  "modified_at": "2025-02-18T16:55:33+00:00",
  "created_at_opencti": "2025-02-18T14:38:48+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2025-02-18",
    "deerstealer",
    "doiloader",
    "fake updates",
    "frigidstealer",
    "gholoader",
    "lumma stealer",
    "macos malware",
    "marcher",
    "socgholish",
    "traffic distribution",
    "web inject"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "slowlysmiling.fastcloudcdn.com"
      },
      {
        "id": "",
        "name": "cloudfasterapp.com"
      },
      {
        "id": "",
        "name": "fastcloudcdn.com"
      },
      {
        "id": "",
        "name": "deski.fastcloudcdn.com"
      },
      {
        "id": "",
        "name": "askforupdate.org"
      },
      {
        "id": "",
        "name": "fbccc8952710a8a50655f4fe3a880c8373411b7ec40e54aabd7eaff3f1d0137b"
      },
      {
        "id": "",
        "name": "e1202c017c76e06bfa201ad6eb824409c2529e887bdaf128fc364bdbc9e1e214"
      },
      {
        "id": "",
        "name": "d34c95c0563c8a944a03ee1448f0084dfb94661c24e51c131541922ebd1a2c75"
      },
      {
        "id": "",
        "name": "ca172f8d36326fc0b6adef9ea98784fd216c319754c5fc47aa91fce336c7d79a"
      },
      {
        "id": "",
        "name": "274efb6bb2f95deb7c7f8192919bf690d69c3f3a441c81fe2a24284d5f274973"
      }
    ],
    "malware": [
      {
        "id": "4d8bf38f-2cb7-4e09-b6bc-d7b9bb616aa9",
        "name": "Gholoader",
        "slug": "gholoader"
      },
      {
        "id": "cc72b19b-2933-4963-92c5-cfad6abc6bb7",
        "name": "DOILoader",
        "slug": "doiloader"
      },
      {
        "id": "e1a484e7-2dfe-4264-bb50-5c9917891ca0",
        "name": "Marcher",
        "slug": "marcher"
      },
      {
        "id": "70840fb3-b756-4c13-a140-9a43a1bb522a",
        "name": "FrigidStealer",
        "slug": "frigidstealer"
      },
      {
        "id": "e4395143-7d7c-450d-8a13-7e17a713fdb6",
        "name": "DeerStealer",
        "slug": "deerstealer"
      },
      {
        "id": "0051da15-675b-4665-a6d1-872f64cf47ea",
        "name": "Lumma Stealer",
        "slug": "lumma-stealer"
      },
      {
        "id": "c58b8795-c3fb-4a18-bbce-13c2ca23c9e7",
        "name": "SocGholish",
        "slug": "socgholish"
      }
    ],
    "intrusion_sets": [
      {
        "id": "1fe327a8-bad3-4f8c-8138-4b05a6d2fe89",
        "name": "TA2726, TA2727",
        "slug": "ta2726-ta2727"
      }
    ],
    "attack_patterns": [
      {
        "id": "64e548d5-24de-4894-9c90-c6e17b3b3bee",
        "name": "T1056.002"
      },
      {
        "id": "e8422fc8-8365-4a6a-a556-d6ec16cb4e5d",
        "name": "T1574.002"
      },
      {
        "id": "1e73eaa9-ea78-444b-b3a3-5842f5d35115",
        "name": "T1074"
      },
      {
        "id": "16e4fc82-7c0b-4d1a-b784-b804b4df26dc",
        "name": "T1204.001"
      },
      {
        "id": "52b92395-d3d3-4e05-976a-0fccccfce8d2",
        "name": "T1566.002"
      },
      {
        "id": "5999052b-e9ae-49e8-9235-d9bf975c22af",
        "name": "T1547.001"
      },
      {
        "id": "a72b6e11-a5d5-4f5a-8f0d-8861e90c34f7",
        "name": "T1555"
      },
      {
        "id": "196f2a64-c55b-47a6-8e38-beb76ba700b6",
        "name": "T1204.002"
      },
      {
        "id": "46ecf5ab-5539-4a8a-aa5b-c180d0ae5a67",
        "name": "T1059.002"
      },
      {
        "id": "97d377d8-89c7-48f8-a79f-0f48bd60df74",
        "name": "T1005"
      },
      {
        "id": "2c3d4267-2bae-41ae-8486-5876953a1748",
        "name": "T1129"
      },
      {
        "id": "cbd87c8c-3bed-461a-acef-56ffc8b87571",
        "name": "T1105"
      },
      {
        "id": "dc342445-1b78-48b4-aa06-89ed2ad7c28e",
        "name": "T1071"
      },
      {
        "id": "7d7ac733-6442-416f-8669-c302dd0843b9",
        "name": "T1036"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Canada"
      },
      {
        "id": "",
        "name": "France"
      },
      {
        "id": "",
        "name": "United Kingdom of Great Britain and Northern Ireland"
      },
      {
        "id": "",
        "name": "United States of America"
      }
    ]
  },
  "external_refs": [
    "https://www.proofpoint.com/us/blog/threat-insight/update-fake-updates-two-new-actors-and-new-mac-malware",
    "https://otx.alienvault.com/pulse/67b4a988f726106d00a91e0e"
  ]
}