New macOS stealer 'Sonoma' hides behind fake Zoom and Brave downloads

Moonlock Lab detailed the Sonoma (SONOMAC1) macOS stealer family from the Crazy Evil group: fake installers for Zoom, StreamYard, Slack and Brave Talk harvest passwords, browser data, Keychain and crypto wallets. The Swift malware bypasses Gatekeeper and is already detected on Macs in Spain and Japan.

• Sonoma is a Swift infostealer with its own loader, tagged SONOMAC1 and sonomab
• Fake DMG and ZIP files pose as Zoom, StreamYard, Slack and Brave Talk
• It steals passwords, Keychain, browser data and crypto wallets
• The loader strips Gatekeeper quarantine via xattr and runs a second stage