Firefox 0-day drops NetWire RAT on crypto exec

A patched Firefox zero-day (CVE-2019-11707) was used in a spearphishing attack to silently install a new OSX.NetWire.A variant on a cryptocurrency exchange employee's Mac.

A user affiliated with a cryptocurrency exchange was targeted with a spearphishing email impersonating an 'Adams Prize' award coordinator, containing a link that exploited an unpatched Firefox vulnerability (now fixed as CVE-2019-11707) to drop persistent macOS malware without any user interaction. Because the exploit delivered the payload directly rather than via a user download, the malicious app never received a quarantine attribute, allowing it to bypass both Gatekeeper and, initially, XProtect scanning logic despite Apple having a matching YARA signature since 2016.

Analysis of the dropped binary (masquerading as Finder.app) showed it shares significant code overlap with a 2012-era OSX.Netwire/Wirenet password-stealing trojan, suggesting a shared author or toolkit lineage, though the 2019 sample's full capabilities differ and were reserved for a follow-up analysis. The malware achieves redundant persistence by installing itself both as a LaunchAgent (RunAtLoad, KeepAlive) and as a macOS Login Item via LSSharedFileListInsertItemURL, ensuring re-execution at every login even at the cost of stealth, since Login Items are visible in system UI.

At time of analysis the sample was detected by only one VirusTotal AV engine (Tencent) despite matching Apple's existing XProtect NetwireA signature from 2016 — a signature that only triggers on quarantined files, again explaining the initial bypass. The exploit landing page was already taken down by the time of investigation, limiting further exploit-chain analysis, but the case illustrates a targeted 0day attack chain against individuals connected to cryptocurrency exchanges.

Source reporting: https://objective-see.org/blog/blog_0x43.html