New Tiny FUD Attacking MacOS Users Bypassing Antivirus and Security Tools

In a concerning development, researchers have uncovered a new macOS backdoor, dubbed Tiny FUD, exploiting sophisticated evasion techniques that bypass antivirus and macOS’s built-in security measures.

The Fully Undetectable (FUD) malware leverages process name spoofing, dynamic library injection (DYLD), and Command-and-Control (C2) communication to establish stealth and persistence, marking a significant evolution in macOS-targeted cyber threats.

Process Manipulation

The Tiny FUD malware exhibits a high degree of ingenuity in remaining undetected.

Analysis of its behavior revealed that it employs process name spoofing by masquerading as legitimate macOS services, such as “com.apple.Webkit.Networking” or “com.apple.Safari.helper.”

This is achieved through the use of osascript commands, making the malware indistinguishable in the system’s Activity Monitor.

The malware dynamically resigns itself with modified entitlements to bypass macOS security features like Gatekeeper, System Integrity Protection (SIP), and executable memory protections.

On execution, the Tiny FUD backdoor connects to a hardcoded C2 server located at 69[.]197[.]175[.]10:9999, where it can receive remote commands, capture screenshots, and transmit sensitive data.

The persistence mechanisms include stealth beacons encoded to evade network anomaly detection, with delays and randomized User-Agent headers mimicking benign web traffic.

Advanced Stealth Capabilities

Tiny FUD’s evasion techniques include:

1. Dynamic Code Signing and Entitlements Modification: The malware generates and applies entitlements allowing actions like disabling executable page protection and enabling DYLD environment variables. These permissions allow the malware to execute unauthorized tasks seamlessly.
2. File Hiding: Using the macOS SetFile command, the malware marks its binary as invisible in Finder, reducing the likelihood of user discovery. However, the file remains accessible through Terminal, reinforcing its deceptive design.
3. Self-Destructive Exit Mechanism: Before termination, the malware cleans up traces of its activity, removing injected libraries, clearing environment variables, and executing a stack canary check to prevent tampering. It forcefully terminates all active processes related to its operation, ensuring no remnants persist for forensic analysis.
4. Heartbeat and Screenshot Collection: Every five minutes, the malware executes a heartbeat, captures system screenshots, and sends them to its C2 server. This feature enhances surveillance by providing operators with visual context from infected systems.

Tiny FUD underscores the growing sophistication of macOS-targeted malware and the urgent need for enhanced security tools capable of detecting stealthy threats.

Its use of legitimate processes and built-in macOS commands highlights a tactical shift in attack methods, leveraging the operating system’s trust model.

Current defenses relying on signature or heuristic-based detection are likely insufficient against such advanced techniques.

Security researchers emphasize the importance of behavioral monitoring and endpoint detection solutions to combat FUD-class malware.

Organizations and individual users are also advised to harden macOS defenses by restricting script execution, monitoring network activity for irregular C2 communications, and ensuring all software is fully updated.

Also Read:

ValleyRAT Targets Accounting Departments with Advanced Delivery Techniques

See more