Firefox 0-day drops NetWire RAT on crypto exec
A patched Firefox zero-day (CVE-2019-11707) was used in a spearphishing attack to silently install a new OSX.NetWire.A variant on a cryptocurrency exchange employee's Mac.
Sourceobjective-see.org — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2019-11707 as exploited in the wild.
- Date
- The source gives no publication date; the date shown is the day Vorant added the brief.
A user affiliated with a cryptocurrency exchange was targeted with a spearphishing email impersonating an 'Adams Prize' award coordinator, containing a link that exploited an unpatched Firefox vulnerability (now fixed as CVE-2019-11707) to drop persistent macOS malware without any user interaction. Because the exploit delivered the payload directly rather than via a user download, the malicious app never received a quarantine attribute, allowing it to bypass both Gatekeeper and, initially, XProtect scanning logic despite Apple having a matching YARA signature since 2016.
Analysis of the dropped binary (masquerading as Finder.app) showed it shares significant code overlap with a 2012-era OSX.Netwire/Wirenet password-stealing trojan, suggesting a shared author or toolkit lineage, though the 2019 sample's full capabilities differ and were reserved for a follow-up analysis. The malware achieves redundant persistence by installing itself both as a LaunchAgent (RunAtLoad, KeepAlive) and as a macOS Login Item via LSSharedFileListInsertItemURL, ensuring re-execution at every login even at the cost of stealth, since Login Items are visible in system UI.
At time of analysis the sample was detected by only one VirusTotal AV engine (Tencent) despite matching Apple's existing XProtect NetwireA signature from 2016 — a signature that only triggers on quarantined files, again explaining the initial bypass. The exploit landing page was already taken down by the time of investigation, limiting further exploit-chain analysis, but the case illustrates a targeted 0day attack chain against individuals connected to cryptocurrency exchanges.
Mentioned in this report
Detection guidance
1 detection for this report is in the app — an indicator rule with Sigma, Splunk SPL, Elastic, Microsoft Defender XDR KQL, and YARA. Free account, no card.
Source reporting: https://objective-see.org/blog/blog_0x43.html
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the CVEs and malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs