Moonlock is a small team that is spread across seven countries and includes a white-hat hacker and a former cybercrime investigator. Between us, we have 47 years of experience in cybersecurity. Back in 2008, when OS X versions were still named after felines, an engineering student built a Mac cleaner in his dorm room. CleanMyMac has since climbed to the top charts of the App Store. MacPaw has since grown into a company ...

About Moonlock

MacPaw develops apps that make your Mac life easier. We do complex things in one click and solve tasks with one tool. Simple is better.

MacPaw | Making Your Mac Life Simpler

Welcome to the CleanMyMac X Knowledge Base! Here you can find answers to your questions and everything else you need to know about CleanMyMac X.

About Moonlock Engine in CleanMyMac X

Welcome to https://moonlock.com (‘Website’)! We are committed to making cybersecurity accessible to anyone by packaging complex cybersecurity technologies into products that anyone can use. The Website is owned and operated by MacPaw Way Ltd., a company duly operated in Cyprus under company ...

The Moonlock Terms of Use

/PRNewswire/ -- Moonlock, a MacPaw division that focuses exclusively on the cybersecurity needs of Mac users, today launched the Scams &amp; Disinformation Survey...

Moonlock, a MacPaw division, reveals: 52% of Americans faced political scams last year

MacPaw has developed Moonlock Engine and will be maintained by a team of cybersecurity researchers and engineers that the company has assembled as a new division. The Moonlock team will focus on emerging security threats aimed specifically at Mac users.

CleanMyMac X Now Has New Malware Removal Tool Powered By Moonlock

Independently verified by AV-TEST. More on Moonlock Engine · Since 2008, we’ve been packaging complex technology into Mac apps even a child can use. And as cyber threats started looming over the Apple ecosystem, they became a special focus of our engineering work. That’s why we launched Moonlock, the cybersecurity wing of MacPaw...

Moonlock: Cybersecurity technology for humans

Here at MacPaw, we put together a dedicated team of cybersecurity researchers and engineers who are well-versed in tackling cybercrimes. This is how the new cybersecurity division was formed to address the security needs of Mac users. Under the funky name Moonlock, these guys have already built their first technology project—a super-advanced wall of protection for your Mac—Moonlock Engine. “Driven by ...

CleanMyMac X is powered by new Moonlock Engine

Moonlock Engine is the anti-malware technology for Mac that powers Malware Removal in CleanMyMac X. Here&#x27;s how it can protect your Mac.

Moonlock Engine: The anti-malware tech for Mac

Among our colleagues at MacPaw 🇺🇦, the Moonlock team is also gearing up for an incredible experience at #SXSW2024! We&#x27;re on a mission to dive deep into the latest trends that are shaping macOS security, the evolving landscape of malware, as well as how Mac users are navigating these challenges – so, always ready to meet up and chat. Let&#x27;s get connected, and happy SXSW! #digitalsafety #moonlock #cybersecurity #cybersecurityawareness ... Ukrainian House powered by ...

Moonlock | LinkedIn

It corresponds to Moonlock’s mission ... humans by packaging complex technologies into tools anyone can use. About Moonlock: Moonlock is a division of MacPaw that focuses exclusively on the cybersecurity needs of Mac users. Moonlock aims to create innovative products that seamlessly protect people from modern threats. About MacPaw: MacPaw is the Ukrainian-born software company known for ...

MacPaw - Moonlock Cybersecuritoons - Cybersecurity Excellence Awards

Agree &amp; Join LinkedIn · By clicking Continue, you agree to LinkedIn’s User Agreement, Privacy Policy, and Cookie Policy

Holger Schulze on LinkedIn: MacPaw - Moonlock Cybersecuritoons - Cybersecurity Excellence Awards

The Ukrainian company MacPaw announces a new cyber security line, Moonlock. Its team will develop effective solutions to strengthen the cybersecurity of Mac users. This was reported by the company’s press service.

MacPaw launches Moonlock to strengthen cyber security for Mac users • Mezha.Media

Moonlock. 38 likes · 115 talking about this. Cybersecurity wing of MacPaw. We pack complex security tech into tools anyone can use.

Moonlock

Exciting news! CleanMyMac X by MacPaw just got a powerful upgrade with the new Moonlock Engine for malware removal! Mark Sparrow is sharing about this awesome…

MacPaw 🇺🇦 on LinkedIn: CleanMyMac X Has New Malware Removal Tool Powered By Moonlock

Moonlock aims to create innovative products that seamlessly protect people from modern threats. About MacPaw: MacPaw is the Ukrainian-born software company known for CleanMyMac X, Setapp, and other innovative macOS and iOS tools, with over 30 million users worldwide.

MacPaw - Moonlock.com Blog - Cybersecurity Excellence Awards

Gridinsoft Anti-Malware does not block moonlock.com. This domain was registered 18 years ago through the company GANDI SAS and had the owner MacPaw Inc.. The contact email for complaint is [email protected] or by phone at +33.170377661.

Moonlock.com (MacPaw) Reviews + Scan Report

Here I downloaded the EICAR test ... company has agreed to detect as malware, for testing purposes. When I last tested CleanMyMac, its scan detected the EICAR file. This time around, the file vanished without any notification. I asked my MacPaw contact whether there was a log I could check, a quarantine list, or some way to verify that CleanMyMac actually did the job. ... According to my contact, “Moonlock Engine entirely ...

CleanMyMac Review | PCMag

MacPaw - Moonlock Mac Security Survey 2023 - Cybersecurity Excellence Awards

Moonlock is an award-winning division of MacPaw that focuses exclusively on the cybersecurity needs of Mac users

CleanMyMac X Has New Malware Removal Tool Powered By Moonlock

Hacker deploys macOS stealer disguised as CleanMyMac crack

Security Bite: Self-destructing macOS malware strain disguised as legitimate Mac app

In the age of ChatGPT, Macs are under malware assault

My go-to cleaning app for Mac just got a major security upgrade

New report: 52% of Americans have faced political scams in past 12 months

Hackers Target macOS Users with Malicious Ads Spreading Stealer Malware

Hackers are using fake 'CleanMyMac' apps to target Mac users

Beware fake CleanMyMac apps that try to steal your passwords and data, company behind the app warns

This GTA6-disguised macOS malware performs heist on Keychain passwords

Billions of Google Chrome users warned to delete ALL popular extensions right now - experts explain why

A new evasive Mac malware strain is stealing crypto

MacPaw introduces on-device phishing detection to boost macOS security

Moonlock (by MacPaw)

Crypto Tool or Data Thief? How Meme-Token-Hunter-Bot and Its Clones Steal from macOS Users

ክሪፕቶ መሣሪያ ወይስ ዳታ ሌባ? Meme-Token-Hunter-Bot እና ክሎኖቹ ከማክሮስ ተጠቃሚዎች እንዴት እንደሚሰርቁ

¿Herramienta criptográfica o ladrón de datos? Cómo el Meme-Token-Hunter-Bot y sus clones roban a los usuarios de macOS

כלי קריפטו או גנב נתונים? כיצד Meme-Token-Hunter-Bot והשיבוטים שלו גונבים ממשתמשי macOS

暗号ツールかデータ泥棒か？Meme-Token-Hunter-BotとそのクローンがmacOSユーザーから盗む方法

Крипто алатка или крадец на податоци? Како Meme-Token-Hunter-Bot и неговите клонови крадат од корисниците на macOS

Alat Kripto atau Pencuri Data? Bagaimana Meme-Token-Hunter-Bot dan Klonnya Mencuri daripada Pengguna macOS

د کریپټو وسیله یا ډیټا چور؟ څنګه Meme-Token-Hunter-Bot او د هغې کلونونه د macOS کاروونکو څخه غلا کوي

¿Cripto Herramientachu icha Datos Suwachu? Imaynatachus Meme-Token-Hunter-Bot chaymanta Clonesnin macOS Usuariokunamanta suwakunku

Kryptoverktyg eller datatjuv? Hur Meme-Token-Hunter-Bot och dess kloner stjäl från macOS-användare

Асбоби крипто ё дузди маълумот? Чӣ тавр Meme-Token-Hunter-Bot ва клонҳои он аз корбарони macOS медузданд

Kripto Aracı mı yoksa Veri Hırsızı mı? Meme-Token-Hunter-Bot ve Klonları macOS Kullanıcılarından Nasıl Çalıyor?

Ithuluzi le-Crypto noma Isela Ledatha? Indlela i-Meme-Token-Hunter-Bot nama-Clones ayo antshontsha ngayo kubasebenzisi be-macOS

Author: Artem Chumak, Malware Research Engineer at Moonlock by MacPaw Introduction In our Moonlock Lab, we have been closely monitoring the evolution of the Atomic stealer. This malware has garnered our attention due to its rapid development and the sophisticated features it employs. One particular feature, which we previously highlighted in our X (Twitter) post, stands out for its advanced capability to replace the legitimate LedgerLive app with a malicious clone. In this article, we delve deeper into this feature and its implications. Monitoring and Analysis Our team continuously monitors Darknet forums and Telegram channels used by threat actors. This activity allows us to stay informed about the latest developments and tactics before they spread among users. By infiltrating these channels, we gain real-time insights into the latest updates in cyber threats. One of the great sources of information has been the Telegram channel operated by the group behind the AMOS stealer. This channel not only facilitates the sale of the malware but also provides updates on its development and deployment. By tracking discussions within this channel, we have been able to document the evolution of the Atomic stealer and understand its dynamics. In fact, the operator's regular posts give insights into future developments and tactics, allowing us to anticipate potential changes. Additionally, we learned about the cost of the particular version of Atomic Stealer. One day, while monitoring the Telegram channel of the AMOS operator, we came across an advertisement highlighting a new functionality. This new feature involves replacing the LedgerLive app with a malicious clone without the user noticing. Furthermore, all user actions with the application - such as opening, closing, entering the seed phrase, and sending the seed phrase - are logged into a separate Telegram channel created by the bot for monitoring purposes. This functionality is offered as a unique module designed for regular customers with stable traffic. The module itself is free, but the operators charge a 30% fee for the balance of each seed phrase collected. LedgerLive App's Infection Chain We were particularly interested in and, therefore, obtained and analyzed this version of Atomic Stealer that primarily targets the LedgerLive app. LedgerLive is a widely used application for managing cryptocurrency wallets, providing users with a secure and convenient way to handle their digital assets. Consequently, due to its popularity and the high value of the assets it manages, it has become a lucrative target for cybercriminals. Let’s examine the infection process, which typically begins when a user downloads a malicious installer disguised as CrackInstall.dmg. Inside this seemingly harmless file is the Mach-O stealer, a piece of malware designed to execute silently once opened. Adversaries often provide visual instructions to help victims bypass Gatekeeper. The instructions guide users to right-click on the CrackInstall file and select "Open" to circumvent the security measure. Upon execution, the stealer immediately gets to work, replacing key components in the LedgerLive app. Specifically, it targets files such as App.tsx, PairMyNano.tsx, and ProtectDiscoverBody.tsx, replacing them with malicious versions. This process effectively creates a clone of the original LedgerLive app. The malicious clone is designed to mimic the legitimate app's appearance and functionality, making it difficult for users to detect the compromise. Key Features Phishing for Seed Phrases One critical feature of the infected LedgerLive app is its ability to display a phishing window. This window prompts users to enter their seed phrases, a set of words used to recover cryptocurrency wallets. The app provides a misleading message to create a false sense of security, encouraging users to divulge their sensitive information. Phishing Message: “Your secret phrase is the secret list of words that you backed up when you first set up your wallet. Ledger does not keep a copy of your recovery phrase.” Data Transmission to Command and Control Servers After capturing the seed phrases, the malware deobfuscates the Command and Control (C2) server and transmits the data to  http://159[.]65[.]193[.]64:8080/statistics. This primary server receives the sensitive information, which the attackers can then exploit. Additionally, the malware sends user information and execution status to two other servers: http://77[.]221[.]151[.]29:8080/statistics_v2 and http://77[.]221[.]151[.]29:8080/statistics_v5. This multi-layered approach to data exfiltration ensures that the attackers receive comprehensive information about the infected systems. Conclusion Our analysis of the Atomic Stealer, particularly its ability to target and replace the LedgerLive app, has revealed its advanced capabilities. The LedgerLive clone mimics the real app, making it difficult for users to detect the compromise. By logging all user interactions, the attackers can capture sensitive information, such as seed phrases, which are crucial for accessing cryptocurrency wallets. To protect yourself, always download software from official sources, avoid clicking on suspicious links, and use robust security tools like CleanMyMac X with Moonlock Engine to detect and block such threats. IoCs Diff of infected and original LedgerLive app: GitHub Gist 304145c8c242644a7aa866383bdac3c169f944ea8c6656b663c223da1359fbb9

SHA256

DMGCrackInstall



0822cf5c34341d124164b1c89889dedc405034e40fd0c8a219859a2561a289ee

SHA256

Mach-O



5c9e197c4e7752e6a15fc9077fa41dc78ac5a737ae73a01ddb6b6fc6aadd1f1c

SHA256

Malicious LedgerLive App Component App.tsx



8c23db010886261cb27a5fbaa45502586f4031cc60bda3a8df778d94a3335888

SHA256

Malicious LedgerLive App ComponentPairMyNano.tsx



9d5bcbdc139561951256a43cc05dda3e18da99ffd200975bbf0732e90a97c710

SHA256

Malicious LedgerLive App ComponentProtectDiscoverBody.tsx



1e86fd2688e7d0086e243194504318c125a5a7c8a1ef6f42bf39bd90deba793b

SHA256

Malicious LedgerLive App Componentapp.asar Author: Artem Chumak, Malware Research Engineer at Moonlock by MacPaw Author: Introduction In our Moonlock Lab , we have been closely monitoring the evolution of the Atomic stealer. This malware has garnered our attention due to its rapid development and the sophisticated features it employs. One particular feature, which we previously highlighted in our X (Twitter) post , stands out for its advanced capability to replace the legitimate LedgerLive app with a malicious clone. In this article, we delve deeper into this feature and its implications. Moonlock Lab Moonlock Lab X (Twitter) post X (Twitter) post Monitoring and Analysis Our team continuously monitors Darknet forums and Telegram channels used by threat actors. This activity allows us to stay informed about the latest developments and tactics before they spread among users. By infiltrating these channels, we gain real-time insights into the latest updates in cyber threats. One of the great sources of information has been the Telegram channel operated by the group behind the AMOS stealer. This channel not only facilitates the sale of the malware but also provides updates on its development and deployment. By tracking discussions within this channel, we have been able to document the evolution of the Atomic stealer and understand its dynamics. malware malware Atomic stealer Atomic stealer In fact, the operator's regular posts give insights into future developments and tactics, allowing us to anticipate potential changes. Additionally, we learned about the cost of the particular version of Atomic Stealer. One day, while monitoring the Telegram channel of the AMOS operator, we came across an advertisement highlighting a new functionality. This new feature involves replacing the LedgerLive app with a malicious clone without the user noticing. Furthermore, all user actions with the application - such as opening, closing, entering the seed phrase, and sending the seed phrase - are logged into a separate Telegram channel created by the bot for monitoring purposes. This functionality is offered as a unique module designed for regular customers with stable traffic. The module itself is free, but the operators charge a 30% fee for the balance of each seed phrase collected. LedgerLive App's Infection Chain We were particularly interested in and, therefore, obtained and analyzed this version of Atomic Stealer that primarily targets the LedgerLive app. LedgerLive is a widely used application for managing cryptocurrency wallets, providing users with a secure and convenient way to handle their digital assets. Consequently, due to its popularity and the high value of the assets it manages, it has become a lucrative target for cybercriminals. Let’s examine the infection process, which typically begins when a user downloads a malicious installer disguised as CrackInstall.dmg. Inside this seemingly harmless file is the Mach-O stealer, a piece of malware designed to execute silently once opened. Adversaries often provide visual instructions to help victims bypass Gatekeeper. The instructions guide users to right-click on the CrackInstall file and select "Open" to circumvent the security measure. Upon execution, the stealer immediately gets to work, replacing key components in the LedgerLive app. Specifically, it targets files such as App.tsx, PairMyNano.tsx, and ProtectDiscoverBody.tsx, replacing them with malicious versions. This process effectively creates a clone of the original LedgerLive app. The malicious clone is designed to mimic the legitimate app's appearance and functionality, making it difficult for users to detect the compromise. Key Features Phishing for Seed Phrases One critical feature of the infected LedgerLive app is its ability to display a phishing window. This window prompts users to enter their seed phrases, a set of words used to recover cryptocurrency wallets. The app provides a misleading message to create a false sense of security, encouraging users to divulge their sensitive information. Phishing Message: “Your secret phrase is the secret list of words that you backed up when you first set up your wallet. Ledger does not keep a copy of your recovery phrase.” Data Transmission to Command and Control Servers After capturing the seed phrases, the malware deobfuscates the Command and Control (C2) server and transmits the data to  http://159[.]65[.]193[.]64:8080/statistics. This primary server receives the sensitive information, which the attackers can then exploit. Additionally, the malware sends user information and execution status to two other servers: http://77[.]221[.]151[.]29:8080/statistics_v2 and http://77[.]221[.]151[.]29:8080/statistics_v5. This multi-layered approach to data exfiltration ensures that the attackers receive comprehensive information about the infected systems. Conclusion Our analysis of the Atomic Stealer, particularly its ability to target and replace the LedgerLive app, has revealed its advanced capabilities. The LedgerLive clone mimics the real app, making it difficult for users to detect the compromise. By logging all user interactions, the attackers can capture sensitive information, such as seed phrases, which are crucial for accessing cryptocurrency wallets. To protect yourself, always download software from official sources, avoid clicking on suspicious links, and use robust security tools like CleanMyMac X with Moonlock Engine to detect and block such threats. Moonlock Engine IoCs Diff of infected and original LedgerLive app: GitHub Gist GitHub Gist GitHub Gist 304145c8c242644a7aa866383bdac3c169f944ea8c6656b663c223da1359fbb9

SHA256

DMGCrackInstall



0822cf5c34341d124164b1c89889dedc405034e40fd0c8a219859a2561a289ee

SHA256

Mach-O



5c9e197c4e7752e6a15fc9077fa41dc78ac5a737ae73a01ddb6b6fc6aadd1f1c

SHA256

Malicious LedgerLive App Component App.tsx



8c23db010886261cb27a5fbaa45502586f4031cc60bda3a8df778d94a3335888

SHA256

Malicious LedgerLive App ComponentPairMyNano.tsx



9d5bcbdc139561951256a43cc05dda3e18da99ffd200975bbf0732e90a97c710

SHA256

Malicious LedgerLive App ComponentProtectDiscoverBody.tsx



1e86fd2688e7d0086e243194504318c125a5a7c8a1ef6f42bf39bd90deba793b

SHA256

Malicious LedgerLive App Componentapp.asar 304145c8c242644a7aa866383bdac3c169f944ea8c6656b663c223da1359fbb9

SHA256

DMGCrackInstall 0822cf5c34341d124164b1c89889dedc405034e40fd0c8a219859a2561a289ee

SHA256

Mach-O 5c9e197c4e7752e6a15fc9077fa41dc78ac5a737ae73a01ddb6b6fc6aadd1f1c

SHA256

Malicious LedgerLive App Component App.tsx 8c23db010886261cb27a5fbaa45502586f4031cc60bda3a8df778d94a3335888

SHA256

Malicious LedgerLive App ComponentPairMyNano.tsx 9d5bcbdc139561951256a43cc05dda3e18da99ffd200975bbf0732e90a97c710

SHA256

Malicious LedgerLive App ComponentProtectDiscoverBody.tsx 1e86fd2688e7d0086e243194504318c125a5a7c8a1ef6f42bf39bd90deba793b

SHA256

Malicious LedgerLive App Componentapp.asar 304145c8c242644a7aa866383bdac3c169f944ea8c6656b663c223da1359fbb9 SHA256 DMGCrackInstall 304145c8c242644a7aa866383bdac3c169f944ea8c6656b663c223da1359fbb9 304145c8c242644a7aa866383bdac3c169f944ea8c6656b663c223da1359fbb9 SHA256 SHA256 DMGCrackInstall DMGCrackInstall 0822cf5c34341d124164b1c89889dedc405034e40fd0c8a219859a2561a289ee SHA256 Mach-O 0822cf5c34341d124164b1c89889dedc405034e40fd0c8a219859a2561a289ee 0822cf5c34341d124164b1c89889dedc405034e40fd0c8a219859a2561a289ee SHA256 SHA256 Mach-O Mach-O 5c9e197c4e7752e6a15fc9077fa41dc78ac5a737ae73a01ddb6b6fc6aadd1f1c SHA256 Malicious LedgerLive App Component App.tsx 5c9e197c4e7752e6a15fc9077fa41dc78ac5a737ae73a01ddb6b6fc6aadd1f1c 5c9e197c4e7752e6a15fc9077fa41dc78ac5a737ae73a01ddb6b6fc6aadd1f1c SHA256 SHA256 Malicious LedgerLive App Component App.tsx Malicious LedgerLive App Component App.tsx 8c23db010886261cb27a5fbaa45502586f4031cc60bda3a8df778d94a3335888 SHA256 Malicious LedgerLive App ComponentPairMyNano.tsx 8c23db010886261cb27a5fbaa45502586f4031cc60bda3a8df778d94a3335888 8c23db010886261cb27a5fbaa45502586f4031cc60bda3a8df778d94a3335888 SHA256 SHA256 Malicious LedgerLive App ComponentPairMyNano.tsx Malicious LedgerLive App ComponentPairMyNano.tsx 9d5bcbdc139561951256a43cc05dda3e18da99ffd200975bbf0732e90a97c710 SHA256 Malicious LedgerLive App ComponentProtectDiscoverBody.tsx 9d5bcbdc139561951256a43cc05dda3e18da99ffd200975bbf0732e90a97c710 9d5bcbdc139561951256a43cc05dda3e18da99ffd200975bbf0732e90a97c710 SHA256 SHA256 Malicious LedgerLive App ComponentProtectDiscoverBody.tsx Malicious LedgerLive App ComponentProtectDiscoverBody.tsx 1e86fd2688e7d0086e243194504318c125a5a7c8a1ef6f42bf39bd90deba793b SHA256 Malicious LedgerLive App Componentapp.asar 1e86fd2688e7d0086e243194504318c125a5a7c8a1ef6f42bf39bd90deba793b 1e86fd2688e7d0086e243194504318c125a5a7c8a1ef6f42bf39bd90deba793b SHA256 SHA256 Malicious LedgerLive App Componentapp.asar Malicious LedgerLive App Componentapp.asar

Tracking Atomic Stealer on macOS: Sophisticated Malware Replacing LedgerLive App

ম্যাকওএস-এ পারমাণবিক চুরির ট্র্যাকিং: লেজারলাইভ অ্যাপ প্রতিস্থাপনকারী অত্যাধুনিক ম্যালওয়্যার

Atomic Stealer auf macOS verfolgen: Ausgefeilte Malware ersetzt LedgerLive-App

Seguimiento de Atomic Stealer en macOS: malware sofisticado que reemplaza la aplicación LedgerLive

Suivi d'Atomic Stealer sur macOS : un malware sophistiqué remplace l'application LedgerLive

मैकओएस पर एटॉमिक स्टीलर को ट्रैक करना: लेजरलाइव ऐप की जगह ले रहा परिष्कृत मैलवेयर

macOS 上の Atomic Stealer を追跡: LedgerLive アプリを置き換える高度なマルウェア

macOS에서 Atomic Stealer 추적: LedgerLive 앱을 대체하는 정교한 맬웨어

Rastreando o Atomic Stealer no macOS: malware sofisticado substituindo o aplicativo LedgerLive

Отслеживание Atomic Stealer на macOS: сложная вредоносная программа, заменяющая приложение LedgerLive

macOS'ta Atomic Stealer'ı Takip Etme: LedgerLive Uygulamasını Değiştiren Karmaşık Kötü Amaçlı Yazılım

Theo dõi Atomic Stealer trên macOS: Phần mềm độc hại tinh vi thay thế ứng dụng LedgerLive

追踪 macOS 上的原子窃取程序：复杂的恶意软件正在取代 LedgerLive 应用程序

This real-time, on-device antiphishing solution for macOS takes reference-based detection to a new level, instantly warning Mac users they are on a phishing website. First, background How many unique phishing websites were published in 2023? The Antiphishing Working Group counted almost 5 million. At the beginning of 2024, MacPaw's cybersecurity division Moonlock reported about the AMOS stealer relying on fake websites of trustworthy brands to spread malware on Apple computers. Not only do they infect our devices, but they also collect victims' credentials for malicious purposes. Spoofed websites are dangerous, so my team and I decided to do something about them. The solution I describe below started as a proof-of-concept experiment at Moonlock. We ironed down the wrinkles at MacPaw's Technological R&D and presented the working prototype at STAST 2024. Our position paper described the solution in detail and was originally uploaded on arXiv.org. For a sneak peek under the hood of our antiphishing app, please read on. What do we have on our hands as of now? Current antiphishing apps primarily use three detection methods: blacklisting, classification-based approach, and reference-based approach. Each method has its advantages, but all require further improvements. Let's explore each of them. Blacklisting The blacklist approach is practical and accurate, but it can't keep up with how quickly phishing websites spread. It's not always effective since new phishing websites might still need to be added to the list, while attackers often change URLs to dodge detection. For instance, Google Safe Browsing uses lists of known phishing sites. When you try to visit a website, it checks the address against this list. If there's a match, it blocks access and warns you about the danger. But what if the website was published mere minutes ago? It won't be on the list, and the user will be trapped. Classification-based approach In this antiphishing method, machine learning analyzes webpage features like URL structures, HTML content, and metadata to determine whether a website is spoofed or legitimate. Classification is excellent for browser extensions because it learns from user data to spot new phishing sites. The disadvantage here is that machine learning requires complex algorithms and lots of training data, while cybercriminals swiftly invent new obfuscation tactics to evade detection. This makes classification-based approaches less accurate and not ideal for standalone security products. Reference-based approach Some of the reference-based solutions are considered state-of-the-art. They use computer vision to analyze webpage appearances and effectively detect phishing websites. What we also see, however, is that reference-based solutions could be faster if they weren’t processing phishing cases in cloud. There's a critical time gap between a phishing website going live and the reference-based detection systems adding it to the list. We wanted to shrink this gap to ensure quicker detection and response. How our native macOS antiphishing app works Our goal was to warn Mac users about phishing websites as soon as they go live. To achieve this, we took the reference-based approach and improved it. We eliminated cloud processing and suggested to do all computations locally, aiming to cut detection time. As a bonus, our solution enhances privacy since all user data is processed on the device and doesn't go anywhere else. We built a native macOS app using Swift, incorporating frameworks for screen capturing and machine learning. By converting our models to CoreML format, we ensured smooth performance and minimized the use of system resources. This way, our prototype continuously scans webpages in the background, protecting Mac users from phishing websites without requiring extra interactions.\The prototype works independently from browsers. The macOS Accessibility framework and Accessibility metadata help the app focus on certain regions of interest so it knows where to look for phishing. Here is how it works in a nutshell. First step: webpage analysis When on a website, our app tries to understand the page layout. It identifies key page elements like logos, input fields, and buttons. For this task, we chose DETR with ResNet-50 because of its accuracy and performance. In this step, it's important to recognize the placements of the elements on the website, particularly the area with a brand logo and forms for entering credentials. Second step: brand attribution Next, the prototype checks if a detected logo on the website matches any well-known brands. On top of it, it compares the webpage URL against a reference list of legitimate websites. If the website is official, we skip further steps. On a side note, we were dismayed to see how many official domains brands use for marketing. It's no wonder phishing websites are so effective at tricking their victims. For example, DHL has several official domains like dhl.com, express.dhl, mydhli.com, dhlsameday.com, and dhlexpresscommerce.com. Third step: prevent credential harvesting We classify the webpage into two categories: whether it requires credentials or not. This step verifies if a phishing website is trying to steal personal user information. In the screenshot, our prototype found credential input fields, attributed the page to DHL, and checked the URL against the list of official DHL domains. The user got a phishing warning since the page does not belong to DHL. How accurate is the prototype? Our system maintains or surpasses baseline accuracy and surely has faster processing times. We achieved a 90.8% accuracy in logo recognition and 98.1% in detecting credential input. The graph below showcases our performance against other antiphishing solutions, and how we compare in precision, recall, and false positive rate. We proudly detected 87.7% of phishing attempts while keeping the false positive rate at a low 3.4%. It's fast and smooth, too The final metrics demonstrate that our solution runs smoothly in the background without a noticeable loss of performance. The use of CPU is minimal: with eight cores in Apple M1 Mac, our prototype uses just 16% of the available 800% capacity. This consumption level is similar to three active Safari tabs or one Zoom call. Final thoughts There are plenty of antiphishing apps on the market, but most of them process data on external servers. Our prototype shows that hardware on modern computers allows us to bring machine learning models locally on-device. We can use them to combat phishing and not worry about processing speeds and the use of system resources. Fortunately, the Apple ecosystem provides frameworks and tools for optimization. Author: Ivan Petrukha, Senior Research Engineer at MacPaw Technological R&D, ex-Moonlock. This real-time, on-device antiphishing solution for macOS takes reference-based detection to a new level, instantly warning Mac users they are on a phishing website. First, background How many unique phishing websites were published in 2023? The Antiphishing Working Group counted almost 5 million. At the beginning of 2024, MacPaw's cybersecurity division Moonlock reported about the AMOS stealer relying on fake websites of trustworthy brands to spread malware on Apple computers. Not only do they infect our devices, but they also collect victims' credentials for malicious purposes. Spoofed websites are dangerous, so my team and I decided to do something about them. counted counted reported reported The solution I describe below started as a proof-of-concept experiment at Moonlock . We ironed down the wrinkles at MacPaw's Technological R&D and presented the working prototype at STAST 2024. Our position paper described the solution in detail and was originally uploaded on arXiv.org . For a sneak peek under the hood of our antiphishing app, please read on. Moonlock Moonlock arXiv.org arXiv.org What do we have on our hands as of now? Current antiphishing apps primarily use three detection methods: blacklisting, classification-based approach, and reference-based approach. Each method has its advantages, but all require further improvements. Let's explore each of them. Blacklisting The blacklist approach is practical and accurate, but it can't keep up with how quickly phishing websites spread. It's not always effective since new phishing websites might still need to be added to the list, while attackers often change URLs to dodge detection. For instance, Google Safe Browsing uses lists of known phishing sites. When you try to visit a website, it checks the address against this list. If there's a match, it blocks access and warns you about the danger. But what if the website was published mere minutes ago? It won't be on the list, and the user will be trapped. Classification-based approach In this antiphishing method, machine learning analyzes webpage features like URL structures, HTML content, and metadata to determine whether a website is spoofed or legitimate. Classification is excellent for browser extensions because it learns from user data to spot new phishing sites. The disadvantage here is that machine learning requires complex algorithms and lots of training data, while cybercriminals swiftly invent new obfuscation tactics to evade detection. This makes classification-based approaches less accurate and not ideal for standalone security products. Reference-based approach Some of the reference-based solutions are considered state-of-the-art. They use computer vision to analyze webpage appearances and effectively detect phishing websites. What we also see, however, is that reference-based solutions could be faster if they weren’t processing phishing cases in cloud. There's a critical time gap between a phishing website going live and the reference-based detection systems adding it to the list. We wanted to shrink this gap to ensure quicker detection and response. How our native macOS antiphishing app works Our goal was to warn Mac users about phishing websites as soon as they go live. To achieve this, we took the reference-based approach and improved it. We eliminated cloud processing and suggested to do all computations locally, aiming to cut detection time. As a bonus, our solution enhances privacy since all user data is processed on the device and doesn't go anywhere else. We built a native macOS app using Swift, incorporating frameworks for screen capturing and machine learning. By converting our models to CoreML format, we ensured smooth performance and minimized the use of system resources. This way, our prototype continuously scans webpages in the background, protecting Mac users from phishing websites without requiring extra interactions.\The prototype works independently from browsers. The macOS Accessibility framework and Accessibility metadata help the app focus on certain regions of interest so it knows where to look for phishing. screen capturing screen capturing CoreML CoreML Accessibility Accessibility Here is how it works in a nutshell. First step: webpage analysis When on a website, our app tries to understand the page layout. It identifies key page elements like logos, input fields, and buttons. For this task, we chose DETR with ResNet-50 because of its accuracy and performance. DETR with ResNet-50 DETR with ResNet-50 In this step, it's important to recognize the placements of the elements on the website, particularly the area with a brand logo and forms for entering credentials. Second step: brand attribution Next, the prototype checks if a detected logo on the website matches any well-known brands. On top of it, it compares the webpage URL against a reference list of legitimate websites. If the website is official, we skip further steps. On a side note, we were dismayed to see how many official domains brands use for marketing. It's no wonder phishing websites are so effective at tricking their victims. For example, DHL has several official domains like dhl.com, express.dhl, mydhli.com, dhlsameday.com, and dhlexpresscommerce.com. Third step: prevent credential harvesting We classify the webpage into two categories: whether it requires credentials or not. This step verifies if a phishing website is trying to steal personal user information. In the screenshot, our prototype found credential input fields, attributed the page to DHL, and checked the URL against the list of official DHL domains. The user got a phishing warning since the page does not belong to DHL. How accurate is the prototype? Our system maintains or surpasses baseline accuracy and surely has faster processing times. We achieved a 90.8% accuracy in logo recognition and 98.1% in detecting credential input. The graph below showcases our performance against other antiphishing solutions, and how we compare in precision, recall, and false positive rate. We proudly detected 87.7% of phishing attempts while keeping the false positive rate at a low 3.4%. It's fast and smooth, too The final metrics demonstrate that our solution runs smoothly in the background without a noticeable loss of performance. The use of CPU is minimal: with eight cores in Apple M1 Mac, our prototype uses just 16% of the available 800% capacity. This consumption level is similar to three active Safari tabs or one Zoom call. Final thoughts There are plenty of antiphishing apps on the market, but most of them process data on external servers. Our prototype shows that hardware on modern computers allows us to bring machine learning models locally on-device. We can use them to combat phishing and not worry about processing speeds and the use of system resources. Fortunately, the Apple ecosystem provides frameworks and tools for optimization. Author: Ivan Petrukha, Senior Research Engineer at MacPaw Technological R&D, ex-Moonlock. Author:

Here’s How we Made a Real-time Phishing Website Detector for MacOS

এখানে আমরা কিভাবে MacOS এর জন্য একটি রিয়েল-টাইম ফিশিং ওয়েবসাইট ডিটেক্টর তৈরি করেছি

So haben wir einen Echtzeit-Phishing-Website-Detektor für MacOS entwickelt

Así es como creamos un detector de sitios web de phishing en tiempo real para MacOS

Voici comment nous avons créé un détecteur de sites Web de phishing en temps réel pour MacOS

हमने MacOS के लिए रियल-टाइम फ़िशिंग वेबसाइट डिटेक्टर कैसे बनाया, यह बताया गया है

MacOS 用のリアルタイム フィッシング サイト検出ツールの作り方

MacOS용 실시간 피싱 웹사이트 감지기를 만든 방법

Veja como criamos um detector de sites de phishing em tempo real para MacOS

Вот как мы создали детектор фишинговых сайтов в реальном времени для MacOS

MacOS için Gerçek Zamanlı Kimlik Avı Web Sitesi Algılayıcısını Nasıl Oluşturduğumuzu İşte Öğrenin

Đây là cách chúng tôi tạo ra một công cụ phát hiện trang web lừa đảo thời gian thực cho MacOS

以下是我们为 MacOS 制作实时钓鱼网站检测器的方法

Hey Hackers! Welcome to another addition to our Company of the Week feature! Every week, we share an awesome tech brand from our tech company database, making their evergreen mark on the internet. This unique HackerNoon database ranks S&P 500 companies and top startups of the year alike. This week, we’re proud to shine a spotlight on Moonlock, a cybersecurity division that protects you every time you use your everyday devices. Specifically made for Mac, Moonlock is on a quest to make the Apple ecosystem as safe as possible by stopping cyber threats from ever reaching you. Want to be featured on HackerNoon’s Company of the Week? Request Your Tech Company Page on HackerNoon! Meet Moonlock: #FunFact Moonlock was made by MacPaw, a company with a long history of creating amazing apps, first starting with CleanMyMac in 2008. Since then, MacPaw hasn’t taken its foot off the gas. On their website, they rightfully boast: Over the years, we’ve made other successful apps. You may have heard of them — after all, there’s a MacPaw app on every 5th Mac in the world. And its success and its long-standing history eventually led MacPaw to Moonlock. With that in mind, let’s learn more about Moonlock itself. Although it’s made up of a small team, they have a combined 47 years of experience in cybersecurity together. Plus, the team includes a white-hat hacker and a former cybercrime investigator. So, it’s no wonder Moonlock is as efficient as it is and that they were able to create the Moonlock Engine, the tech behind Malware Remove. Moonlock Engine quickly scans your devices, detects malware, and then gets rid of it. It’s just that simple. Here are 3 more important things you need to know about Moonlock Engine, taken straight from the horse’s mouth (or in this case, its website): Moonlock Engine inspects mail attachments, DMG and ZIP archives, USB drives, browser extensions, and launchers to ensure that no malware slips through the cracks.


Moonlock Engine has a lightning-fast scan: now 2x faster on M1-powered Macs and 1.5x faster on Intel-based computers.


Moonlock Engine is independently verified by AV-TEST and was able to detect 93.3% of malicious samples during a private test. Share Your Company's Story via HackerNoon Moonlock 🤝HackerNoon Moonlock has now turned its sights on HackerNoon and has partnered with us for our business blogging program. So far, Moonlock’s stories have garnered over 9.5k reads and counting! Check them out to learn more about how you can stay safe on the internet: Crypto Tool or Data Thief? How Meme-Token-Hunter-Bot and Its Clones Steal from macOS Users
Here’s How We Made a Real-time Phishing Website Detector for MacOS
Tracking Atomic Stealer on macOS: Sophisticated Malware Replacing LedgerLive App Like 4000+ other brands, you can also benefit from publishing on HackerNoon:Learn more about HackerNoon’s Business Blogging Program
Learn about our Technology Press Release Program. That’s it for this week! Until next time, The HackerNoon team Hey Hackers! Welcome to another addition to our Company of the Week feature! Every week, we share an awesome tech brand from our tech company database , making their evergreen mark on the internet. This unique HackerNoon database ranks S&P 500 companies and top startups of the year alike. Company of the Week tech company database This week, we’re proud to shine a spotlight on Moonlock , a cybersecurity division that protects you every time you use your everyday devices. Specifically made for Mac, Moonlock is on a quest to make the Apple ecosystem as safe as possible by stopping cyber threats from ever reaching you. Moonlock Want to be featured on HackerNoon’s Company of the Week? Request Your Tech Company Page on HackerNoon! Want to be featured on HackerNoon’s Company of the Week? Request Your Tech Company Page on HackerNoon ! Want to be featured on HackerNoon’s Company of the Week? Request Your Tech Company Page on HackerNoon Want to be featured on HackerNoon’s Company of the Week? Request Your Tech Company Page on HackerNoon Meet Moonlock: #FunFact Moonlock was made by MacPaw, a company with a long history of creating amazing apps, first starting with CleanMyMac in 2008. Since then, MacPaw hasn’t taken its foot off the gas. On their website , they rightfully boast: Moonlock website Over the years, we’ve made other successful apps. You may have heard of them — after all, there’s a MacPaw app on every 5th Mac in the world. Over the years, we’ve made other successful apps. You may have heard of them — after all, there’s a MacPaw app on every 5th Mac in the world. And its success and its long-standing history eventually led MacPaw to Moonlock. With that in mind, let’s learn more about Moonlock itself. Although it’s made up of a small team , they have a combined 47 years of experience in cybersecurity together. Plus, the team includes a white-hat hacker and a former cybercrime investigator. small team So, it’s no wonder Moonlock is as efficient as it is and that they were able to create the Moonlock Engine, the tech behind Malware Remove. Moonlock Engine quickly scans your devices, detects malware, and then gets rid of it. It’s just that simple. Here are 3 more important things you need to know about Moonlock Engine, taken straight from the horse’s mouth (or in this case, its website): Here are 3 more important things you need to know about Moonlock Engine, taken straight from the horse’s mouth (or in this case, its website ): website Moonlock Engine inspects mail attachments, DMG and ZIP archives, USB drives, browser extensions, and launchers to ensure that no malware slips through the cracks. Moonlock Engine has a lightning-fast scan: now 2x faster on M1-powered Macs and 1.5x faster on Intel-based computers. Moonlock Engine is independently verified by AV-TEST and was able to detect 93.3% of malicious samples during a private test. Moonlock Engine inspects mail attachments, DMG and ZIP archives, USB drives, browser extensions, and launchers to ensure that no malware slips through the cracks. Moonlock Engine inspects mail attachments, DMG and ZIP archives, USB drives, browser extensions, and launchers to ensure that no malware slips through the cracks. Moonlock Engine has a lightning-fast scan: now 2x faster on M1-powered Macs and 1.5x faster on Intel-based computers. Moonlock Engine has a lightning-fast scan: now 2x faster on M1-powered Macs and 1.5x faster on Intel-based computers. Moonlock Engine is independently verified by AV-TEST and was able to detect 93.3% of malicious samples during a private test. Moonlock Engine is independently verified by AV-TEST and was able to detect 93.3% of malicious samples during a private test. Share Your Company's Story via HackerNoon Share Your Company's Story via HackerNoon Share Your Company's Story via HackerNoon Share Your Company's Story via HackerNoon Moonlock 🤝HackerNoon Moonlock has now turned its sights on HackerNoon and has partnered with us for our business blogging program . So far, Moonlock’s stories have garnered over 9.5k reads and counting! Moonlock business blogging program Check them out to learn more about how you can stay safe on the internet: Crypto Tool or Data Thief? How Meme-Token-Hunter-Bot and Its Clones Steal from macOS Users Here’s How We Made a Real-time Phishing Website Detector for MacOS Tracking Atomic Stealer on macOS: Sophisticated Malware Replacing LedgerLive App Crypto Tool or Data Thief? How Meme-Token-Hunter-Bot and Its Clones Steal from macOS Users Crypto Tool or Data Thief? How Meme-Token-Hunter-Bot and Its Clones Steal from macOS Users Crypto Tool or Data Thief? How Meme-Token-Hunter-Bot and Its Clones Steal from macOS Users Here’s How We Made a Real-time Phishing Website Detector for MacOS Here’s How We Made a Real-time Phishing Website Detector for MacOS Here’s How We Made a Real-time Phishing Website Detector for MacOS Tracking Atomic Stealer on macOS: Sophisticated Malware Replacing LedgerLive App Tracking Atomic Stealer on macOS: Sophisticated Malware Replacing LedgerLive App Tracking Atomic Stealer on macOS: Sophisticated Malware Replacing LedgerLive App Like 4000+ other brands, you can also benefit from publishing on HackerNoon:Learn more about HackerNoon’s Business Blogging Program Learn about our Technology Press Release Program. Like 4000+ other brands, you can also benefit from publishing on HackerNoon:Learn more about HackerNoon’s Business Blogging Program Like 4000+ other brands, you can also benefit from publishing on HackerNoon: Learn more about HackerNoon’s Business Blogging Program Learn more about HackerNoon’s Business Blogging Program Learn more about HackerNoon’s Business Blogging Program Learn about our Technology Press Release Program . Learn about our Technology Press Release Program Learn about our Technology Press Release Program Learn about our Technology Press Release Program . . That’s it for this week! Until next time, The HackerNoon team

Moonlock (by MacPaw)

moonlock.com

501-1000 employees

Since 2008

COMPANY RANKING

MOONLOCK (BY MACPAW)

EVERGREEN INDEX #31

Moonlock (by MacPaw) WIKI

Moonlock (by MacPaw)

moonlock.com

501-1000 employees

Since 2008

COMPANY RANKING

MOONLOCK (BY MACPAW)

EVERGREEN INDEX #31

HACKERNOON STORIES ON MOONLOCK (BY MACPAW)

MOONLOCK (BY MACPAW) NEWS & MENTIONS

Moonlock (by MacPaw) WIKI