macOS Users Beware! Hackers Allegedly Offering Full System Control Malware for Rent

A new concerning threat has emerged in the cybercriminal ecosystem targeting Apple users. A sophisticated macOS malware-as-a-service offering called “iNARi Loader” is being advertised on underground forums.

This high-priced stealer represents an alarming evolution in the growing landscape of macOS-specific malware, combining remote desktop capabilities with advanced data exfiltration techniques.

According to a dark web post observed by Cyber Security News, the threat actor behind iNARi Loader is offering this private macOS stealer with an extensive feature set that surpasses previous iterations of similar malware. 

The malware reportedly includes modular capabilities allowing attackers to deploy various payloads ranging from VNC (Virtual Network Computing) remote access to sophisticated data stealers.

One of the most concerning aspects of iNARi Loader is its ability to bypass password prompts, potentially giving attackers unrestricted access to sensitive user data. 

This technique resembles methods used by previous macOS infostealers like Atomic Stealer, which employs fake system prompts to harvest user credentials.

Researchers noted that this represents a significant escalation in macOS-targeted threats. Further, the inclusion of remote desktop functionality gives attackers unprecedented control over compromised systems.

Hackers Offering Malware for Rent

According to dark web advertisements observed by Cyber Security News, the malware can reportedly be delivered through multiple vectors, including terminal commands, disk image files (.dmg), package installers (.pkg), or malicious applications. 

This multi-pronged approach maximizes the attackers’ chances of successfully compromising target systems.

Unlike many competing products that require additional obfuscation, iNARi allegedly doesn’t need crypting services to evade detection, suggesting sophisticated built-in evasion capabilities similar to those observed in other recent macOS malware families.

The threat actor has established a tiered pricing model that reflects the malware’s advanced capabilities:

• Standard version: $5,000 per month
• Premium version: $10,000 per month (includes remote desktop protocol access, technical support, and early access to new modules)

These prices significantly exceed those of previous macOS stealers like Atomic ($1,000-$3,000/month) and Banshee ($3,000/month), indicating either exceptional capabilities or targeted marketing toward well-funded threat actors.

The emergence of iNARi Loader continues a troubling trend of increased targeting of macOS systems. 

Throughout 2023 and early 2024, researchers documented multiple new infostealer families, including MacStealer, Pureland, Atomic, RealStealer, MetaStealer, and Banshee.

These malware families typically target sensitive information, including Keychain passwords, browser data, cryptocurrency wallets, and personal files. 

The addition of remote desktop capabilities represents a significant escalation, giving attackers data theft capabilities and persistent control over compromised systems.

Users should remain vigilant against suspicious download prompts, verify software authenticity, enable two-factor authentication on sensitive accounts, and ensure their systems are running the latest security updates. 

Find this News Interesting! Follow us on Google News, LinkedIn, & X to Get Instant Updates!