If it isn’t, FinSpy will decrypt and unpack a Zip archive containing an installer and several tools designed to obtain elevated (administrative) system privileges. If launched, the spyware will first check to see if it is running inside a virtual machine (VM). The macOS version of FinSpy comes in the form of a Trojanized app installer containing encrypted files. A few days ago, Amnesty International publicly disclosed these new variants in an effort to help the security community as well as human rights advocates. In the course of their subsequent research, they also discovered macOS and Linux FinSpy variants - although these appeared to be the work of a different attacker altogether.

The attacks were attributed to the NilePhish attacker group and were believed to be state sponsored. How does the macOS variant of FinSpy work?īack in 2019, Amnesty International was investigating a coordinated phishing campaign that was targeting human rights advocates in Egypt. In addition, the spyware contains modules designed to allow attackers to control it remotely and execute commands on the infected system. According to the Amnesty International report, modern versions of FinSpy can monitor emails and communications, log keystrokes, record audio and video, gather information about network activity, and provide detailed access to system files. What can FinSpy do?įinSpy is designed to provide full-spectrum surveillance on a compromised machine. FinSpy has been used in this manner in Bahrain, Ethiopia, Uganda, and Egypt.

There are (arguably) legitimate uses of such monitoring software, for example in criminal and anti-terrorism investigations however, FinSpy’s manufacturers have come under fire for selling their product to repressive and anti-democratic regimes that use the software to surveil human rights activists, journalists, dissidents, and even opposition political parties. What is FinSpy?įinSpy is commercial spyware, produced by a private company and sold to law enforcement and intelligence agencies around the world. In this article, we’ll tell you what they found, share some technical details uncovered by Amnesty’s malware analysts, and explain what it means for security and privacy. Researchers at Amnesty International have just announced the discovery of FinSpy spyware variants that target macOS and Linux users.

Spyware on mac