A link in the body of the message downloads an encrypted zip that contains a DMG file.

This technique has been observed ITW to deliver Meta Stealer, Atomic Stealer, and other MacOS malware.

Notably, in some instances, the attacker poses as a recruiter and initiates back and forth conversation with the recipient.

Read More

This rule identifies PDF attachments that either link directly to a DMG file, link to a ZIP archive containing a DMG file, or link to an encrypted ZIP containing a DMG file. This technique has been observed delivering MetaStealer Malware.

Read More