[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fO3gF1fvFZMNbI1Ut48kgG-oDHHVjj7XFe8fPQ8kcQwo":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"status":17,"created_at":18,"published_at":19,"article":20,"tags":24,"podcasts":37},"ee4a5b15-db45-489d-9a04-8e5122d83d71","macos-crypto-malware-exploits-social-engineering-and-system-permissions","563bd48d-8361-4afa-8087-b10a1ab4e77e","macOS Crypto Malware Exploits Social Engineering and System Permissions","The notnullOSX malware demonstrates how attackers combine sophisticated social engineering with macOS permission abuse to target high-value cryptocurrency assets. By masquerading as legitimate documents and applications, the malware tricks users into granting Full Disk Access, enabling it to steal sensitive wallet data including seed phrases and private keys. This attack highlights the critical importance of user education and proper data protection measures for cryptocurrency storage, especially for wallets containing significant amounts.","**Immediate actions:**\n- Review and revoke unnecessary Full Disk Access permissions for all installed applications\n- Verify the authenticity of all cryptocurrency wallet applications through official channels\n- Move high-value cryptocurrency assets to offline hardware wallets stored securely\n\n**Long-term improvements:**\n- Implement comprehensive security awareness training focused on social engineering tactics\n- Establish strict policies for granting system permissions to applications\n- Deploy endpoint detection and response (EDR) solutions on all macOS devices\n\n**Detection measures:**\n- Monitor system logs for unusual application permission requests and file access patterns\n- Set up alerts for cryptocurrency wallet application installations and modifications\n- Regularly audit installed applications and their permission levels",[12,13,14,15,16],"CIS Control 14 (Controlled Access Based on the Need to Know)","NIST SP 800-53 AT-2 (Awareness and Training)","CIS Control 5 (Account Management)","NIST SP 800-53 SI-3 (Malicious Code Protection)","CIS Control 8 (Audit Log Management)","published","2026-04-09T12:09:00.272746+00:00","2026-04-09T12:08:59.961+00:00",{"id":7,"url":21,"slug":22,"title":23},"https:\u002F\u002Fhackread.com\u002Fmacos-malware-notnullosx-crypto-wallets\u002F","new-macos-malware-notnullosx-targets-crypto-wallets-over-10k-d64008","New macOS Malware notnullOSX Targets Crypto Wallets Over $10K",[25,31],{"id":26,"name":27,"slug":28,"description":29,"color":30},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":32,"name":33,"slug":34,"description":35,"color":36},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[]]