CleanMyMac impersonation: How cybercriminals use fake software to steal your data

As malware researchers in Moonlock, the cybersecurity division of MacPaw, we are always on the lookout for new samples to analyze and protect our users from. One day, we came across a sample with the name CleanMyMac, which caught our attention. However, this sample was not the genuine CleanMyMac, but a malicious impersonation.

We decided to investigate this campaign further and uncovered many more samples with different malware inside, such as Atomic Stealer, PSW Stealer, and AdLoad Adware. These malware can steal users' passwords and personal data and display unwanted ads on their Macs. The samples had different file types, such as macho files, dmg, shell scripts, etc. Fortunately, our Lab is always updating the rules to detect such threats, and users who use the official CleanMyMac X with the Moonlock Engine will be safe from these attacks.

How cybercriminals spread CleanMyMac impersonation

However, not all users are aware of the dangers of downloading software from untrusted sources. We found several pages from which the malicious software was distributed. These were phishing pages that leveraged MacPaw's name and logo and manipulated users' trust. Among these pages were macpaw[.]us, cleanmymac[.]pro, mac-clean[.]org, and others. These pages looked very similar to the official MacPaw website but had subtle differences and errors. For now, these pages do not respond, but they might resurface under different domains.

Phishing URLs are not enough to spread malware, so the attackers also use different channels to promote their software. For example, YouTube channels. When we searched for "cleanmymac x free download full version" on YouTube, we uncovered dozens of videos from a hijacked YouTube channel called COVISAR TV.

This channel had nothing to do with MacPaw or CleanMyMac. It had many videos of Portuguese musical bands, but the last videos were all about CleanMyMac and how to mine or recover bitcoins. These videos have links to the phishing pages in their descriptions. This looked like a scam, and indeed, MacPaw's security team confirmed that they had no idea what the advertising campaign and website were.

How to protect your Mac from malware

This is just one example of how cybercriminals can impersonate legitimate software and companies to trick users into downloading malware. Impersonation attacks are a serious threat to users' security and privacy, and they can cause financial, emotional, and reputational damage. Therefore, it is important to raise awareness about these attacks and how to prevent them. Here are some tips to avoid falling victim to impersonation attacks:

1. Always download software from the official website or the App Store. Do not trust links from unknown sources or third-party websites.
2. Check the website URL before downloading anything. Look for spelling errors, unusual characters, or different domains. For example, the official MacPaw website is macpaw.com, not macpaw.us or macpaw.pro
3. Verify the identity of the sender or the publisher of the software. Look for signs of authenticity, such as digital signatures, certificates, or reviews. If you are unsure, contact the company directly and ask for confirmation.
4. Use a reliable antivirus or Mac cleaner software, such as CleanMyMac X with the Moonlock Engine, to scan your Mac regularly and remove any threats. Keep your software updated and follow the security recommendations.

By following these tips, you can protect yourself and your Mac from impersonation attacks and enjoy a safe and smooth online experience 🙂

MITRE ATT&CK® Techniques

Indicators of Compromise (IOC)