Pirate sites spread malware posing as CleanMyMac and Photoshop

The most important duty of cybersecurity researchers is to keep users informed about emerging threats and vulnerabilities. So today, we delve into the world of cracked software distribution and discover how threat actors exploit the trust of unsuspecting users to deceive them into installing malware.

In response to the high demand for cracked software, sites have emerged that distribute a wide array of applications, offering pirated versions of popular pieces of software whose copy protection mechanisms have been circumvented. One such site that has come under our scrutiny is haxmac[.]cc, a famous hub for users seeking cracked applications for macOS. 

Sites hosting cracked macOS apps are spreading malware

Interestingly, haxmac[.]cc is visited by half a million users per month, with 207,000 of those users being unique. This constitutes significant traffic and, in the event of malware being hosted, poses the possibility that many devices could be infected.

A whopping 26.97% of the site’s traffic originates from organic search results. It looks like threat actors exploit trust in Google’s search rankings. By allegedly manipulating search engine optimization (SEO) tactics, they can elevate haxmac[.]cc to the top of search results for queries such as “download crack app macOS.”

The website in question positions itself as a repository for cracked macOS software, serving as a haven for individuals seeking cracked versions of Adobe Photoshop, Adobe Illustrator, SQLPro, CleanMyMac X, and numerous other macOS applications.

While the site appears to offer a range of legitimate software downloads, redirecting users to other services where non-malicious files are available for download, it has been discovered that clicking on the “Download Now” or the “Direct Download” button triggers the download of a malicious dmg file named “app_SM_v1.1.1.dmg,” which contains the Atomic Stealer malware. 

Atomic Stealer malware found disguised as trusted software

Atomic Stealer is a sophisticated malware strain known for its stealthy capabilities and advanced functionality in stealing sensitive information. In its latest versions, it employs intricate techniques to evade detection by security software.

Once inside a system, Atomic Stealer can harvest a wide range of data, including credentials, financial information, and intellectual property, transmitting it back to its operators for exploitation.

Notably, it doesn’t matter which app from the catalog you want to download. Whether it’s CleanMyMac X, Adobe Photoshop, or something else, clicking “Download Now” or “Direct Download” will lead to the same DMG file being downloaded.

What we know about the distribution method

What sets this scheme apart is the cunning targeting that is being employed by the threat actors. Rather than casting a wide net and delivering the same malware to all users, they tailor their attacks based on the victim’s browser by leveraging the User-Agent header.

Safari users are served the macOS-specific Atomic Stealer, while those using Chromium-based browsers are redirected to a page hosting a zip archive containing the Remcos RAT, a notorious piece of Windows-targeting malware. By adapting their payload according to the victim’s browser, the threat actors increase the likelihood of successful infection.

While preparing this article, we also noted that this is still an active campaign. When we posted about this case via our X account, Chrome users were redirected to https[:]//6ejj9u56155[.]cfd. After a few days, however, they began to be redirected to https[:]//18jmx150pt[.]cfd.

Now, the buttons that previously led to malicious software have been removed, most likely to avoid detection. This adaptiveness may indicate the agility of the threat actors behind the campaign.

It’s worth noting that haxmac[.]cc is not an isolated case. While searching for “download crack pc app,” we encountered another similar page: haxpc[.]net.

On this site, we found familiar buttons that led to downloading App_v1.0.4.dmg, a file containing a new variant of Atomic Stealer, which was detected by only 5 vendors on VirusTotal.

Moreover, many similar cracked software distribution sites have been found to distribute the Atomic Stealer malware. This seems to suggest a coordinated effort across multiple platforms.

Threat actors leveraging PPI through affiliate networks

It has become apparent that the distribution method is likely tied to a pay-per-install (PPI) service. This model incentivizes threat actors to distribute malware through affiliate networks, earning them a commission for each successful installation on a victim’s system.

In addition, we have observed PPI services being advertised and endorsed across multiple channels on Telegram, a popular messaging platform known for its privacy features, which often serve as hubs for cybercriminal collaboration and the exchange of malicious tools and techniques.

How to stay safe: Avoid cracked software

Our investigation into cracked software distribution revealed a complex web of deceit orchestrated by threat actors, posing significant risks to millions of users. The dynamic nature of these campaigns, as evidenced by the changing redirection URLs and the removal of incriminating buttons on haxmac[.]cc, underscores the adaptability and persistence of these adversaries. 

For users, it’s crucial to avoid downloading cracked software or software from untrusted sources. Stick to official app stores and reputable websites.

Always keep your software and operating systems up to date. Additionally, using antivirus software such as CleanMyMac X, powered by Moonlock Engine, and being cautious of suspicious links or downloads can greatly reduce your risk of malware infections.

Indicators of Compromise (IOC)

Co-author: Artem Chumak

Kseniia Yamburh

Kseniia is a malware research engineer at Moonlock, specializing in OSINT intelligence gathering and analysis. Her passion lies in writing about new investigations and findings in the field of cybersecurity.