USBportin

USBportin is a malware strain that targets macOS systems. It was first identified in early 2020. The malware is designed to steal user credentials and sensitive data from infected computers.

The primary method of distribution for USBportin is through infected USB drives. When an infected drive is connected to a macOS computer, the malware can automatically execute, or it may trick the user into launching it. Once active, USBportin establishes persistence on the system, meaning it can remain on the computer even after reboots.

The malware's capabilities include harvesting login information for various applications and services, such as web browsers and email clients. It can also exfiltrate files and other sensitive data from the infected machine. USBportin has been observed to communicate with a command-and-control (C2) server, allowing attackers to remotely manage the infected system and download additional malicious payloads.

Security researchers have noted that USBportin's code shares similarities with other macOS malware families, suggesting a possible common origin or developer. The detection and removal of USBportin involve using reputable antivirus software designed for macOS. Users are advised to exercise caution when connecting unknown USB devices to their computers and to keep their operating systems and security software updated.