Mosyle discovered a new Mac malware strain named JSCoreRunner that spreads via a fake file-conversion site (fileripple[.]com) and evaded VirusTotal detections at discovery, using a two-stage installer to disable macOS quarantine and deliver a second unsigned payload. The malware hijacks Google Chrome search settings to redirect users to a fraudulent search engine, enabling keylogging, phishing, and potential data/financial theft. #JSCoreRunner #FileRipple #fileripple
Keypoints
- Mosyle identified a zero-day Mac threat named JSCoreRunner distributed via a fake PDF/file conversion site (fileripple[.]com).
- The attack uses a two-stage installer: FileRipple.pkg (first-stage, appears legitimate) and Safari14.1.2MojaveAuto.pkg (second-stage, unsigned payload).
- The first-stage installer removes the macOS quarantine attribute to allow the second-stage unsigned package to bypass Gatekeeper.
- JSCoreRunner targets Google Chrome profiles, modifying search engine settings by creating a TemplateURL to redirect searches to a fraudulent provider.
- The malware hides activity by passing arguments to Chrome to suppress crash logs and restore/session prompts, aiding stealth.
- Mosyle provided multiple file hashes for both stages and components to aid detection and IOCs for defenders.
- The campaign underscores the risk of malicious file-conversion sites and the need for multi-layered defenses and user education.
MITRE Techniques
- [T1204] User Execution – JSCoreRunner is distributed via a fake file-conversion website that tricks users into downloading and installing FileRipple.pkg (“…appears and even work as a real PDF converter but behind the scenes it’s setting up to expose the user.”).
- [T1112] Modify Registry/Configuration (macOS settings) – The malware removes the quarantine attribute and alters system/application settings to allow unsigned payload execution (“…quietly removed the quarantine attribute within macOS…”).
- [T1218] Signed Binary Proxy Execution (bypass) – The campaign uses a revoked-signed first-stage and an unsigned second-stage to bypass macOS protections and Gatekeeper (“This package was signed by a developer whose signature was revoked by Apple… the second stage… is unsigned and therefore not blocked by default.”).
- [T1036] Masquerading – FileRipple.pkg masquerades as a legitimate PDF conversion utility and even displays a fake webview to appear legitimate (“…creates a fake webview, displaying a preview of a legitimate-looking PDF tool while the malicious activity runs silently in the background.”).
- [T1059] Command and Scripting Interpreter – The second-stage sends a request to a command-and-control server and executes binaries to complete payload setup (“It first sends a request to a command-and-control server to confirm the installation. It then identifies the real user, removes the quarantine attributes… and sets the path to execute the main binary.”).
- [T1110] Brute Force / Credential Access (Browser hijacking) – JSCoreRunner modifies Chrome profiles and search engine settings to redirect searches and enable potential credential/data theft (“…modifies the search engine settings by creating a new TemplateURL object… redirect users to a fraudulent search engine.”).
Indicators of Compromise
- [File Hash ] first-stage package and components – FileRipple.pkg: 3634d1333e958412814806a5d65f1d82536d94cac21ec44b8aba137921ae3709, FileRipple(Mach-O): 5828ab3abf72c93838a03fb5a9ca271ddbb66ad4b3a950668a22cd8f37ac9b04
- [File Hash ] post-install and second-stage hashes – FileRipplle(PostInstall): 6c5e51e7aeb1836d801424f20ffd56734cdc35a75ae3cca88002f94c40949a27; Safari14.1.2MojaveAuto.pkg: 23186719325c87eb4e17aae0db502e78fb24598e97c8a9c151d7c347e72c0331
- [File Hash ] additional binaries/scripts – Updater(mach-o): a7a02c6f5073133added3bfc9c67ca385168ba35469752fcddf5e1ed5fcef1ce; Preinstall: 35c64a2111c0b8e728ee82db3d727319720e612e9a3dfe85d445f5b90fc1485a
- [File Hash ] more components – Postinstall: 84f8e3f996cf907f71ee4823c1bc91a82589c5e4fcd98a9084e51b02ad3515dd; Javascript(Obfuscated): a86fe93e1a4c451c11b628f622b80770f40254de4a050bbe8e4caae7ef89dfa4
- [Domain ] distribution site – malicious file-conversion site used to distribute the installers: fileripple[.]com