CloudMensis Mac virus (Free Guide)

What is CloudMensis Mac virus?

CloudMensis is a dangerous Mac infection that operates as a backdoor

CloudMensis is a malicious Mac application that could seriously compromise one's privacy and safety

CloudMensis is a Mac virus that was recently spotted by security researchers by the ESET security team^[1] in the second half of July 2022. The first attacks emerged back in February, and it seems like all of them are targeted, which means that infecting regular computer users is unlikely to be cybercriminals' goal.

CloudMensis operates as a backdoor; once installed on the system, it is capable of performing cybercriminals' commands remotely. Its main goal is to steal various valuable information, including emails, documents, keystrokes, and even screen captures. Data theft of such magnitude can result in various personal security and privacy issues, thus the infection should be found and eliminated as soon as possible.

The virus is brand new and has never been discovered or analyzed before, which may result in serious challenges for security software initially. Luckily, because of the discovery, malware can be easily analyzed, detected, and removed from the system. In this article, we will explain how to do just that.

CloudMensis overview

Since malware is relatively new in the security landscape, little is known about its developer and distributor. According to security experts, the distribution of CloudMensis is relatively limited, which suggests that it is used as a part of a targeted attack. The authors of this one choose to target individuals of interest exclusively, and they do that with the help of software vulnerabilities on some of the Mac machines.

Researchers said that, despite malware exploiting unpatched macOS systems, there were no zero-day flaws^[2] used at the time of the research. This means that most of the attacks can be mitigated by ensuring that all the available updates are installed on the system and the existing vulnerabilities patched.

One of the unique features of malware comes from its communication with a remote C2^[3] server – it is located on cloud storage with three supported providers (Dropbox, pCloud, and Yandex Disk). This fact prompted the researchers to name the virus CloudMensis.

From the Command and Control server, cybercriminals can issue as many as 39 commands for the malware to execute. Several of those are dedicated to performing data exfoliation functions, which may target private documents, emails, pictures, databases, and other files. It can also record keystrokes and gain access to the camera and microphone, increasing the scope of spying conducted. Keystroke logs can also help cybercriminals to steal various sensitive data, including account passwords, credit card details, and more.

There are speculations that malware was developed by less experienced hackers, or maybe those who are less familiar with Mac development, as there is very little obfuscation during the intrusion and the operation of the virus. Despite this, if no adequate security solution is used, CloudMensis can serve as a relatively advanced spying tool that can exfoliate crucial sensitive information from its targets.

CloudMensis can be detected by numerous security applications

CloudMensis removal

As previously mentioned, the malware does not use sophisticated evasion methods during its operation. Nonetheless, once the existing Mac's vulnerabilities are exploited, it can place a malicious daemon on the system, which can significantly prolong its silent operation in the background if not taken care of.

Therefore, we recommend using sophisticated security tools, such as SpyHunter 5Combo Cleaner or Malwarebytes, to deal with the infection. Unlike any other regular Mac application, you won't be able to simply drag the CloudMensis app into Trash, as the entry would simply not exist in this place. Malware is a complex software that often uses various ways to disguise itself, preventing users from successfully finding and removing it.

Once the operating system is breached and the built-in security systems of Mac bypassed, the malware can run in the background unnoticed, stealing very sensitive user data in the meantime. This is why it is important to perform a full system scan with anti-malware and then make sure that all the system updates are patched.

Clean your browser

Upon infiltration, the virus may affect Safari or another web browser as well. For example, it was determined that it meddles with files within Safari's cache folder and may insert its own files. Therefore, we highly recommend you clean your browsers after you remove malware from your system. You can either employ FortectIntego for the job (which can also clear various junk files from the system) or use the manual method instead:

Safari

1. Click Safari > Clear History…
2. From the drop-down menu under Clear, pick all history.
3. Confirm with Clear History.

Google Chrome

1. Click on Menu and pick Settings.
2. Under Privacy and security, select Clear browsing data.
3. Select Browsing history, Cookies and other site data, as well as Cached images and files.
4. Click Clear data.